PREFACE
A free, fair and secure cyberspace is foundation of vital economic development and it contributes to thepeace and stability of the international community and Japan. Knowledge, technologies, and services incyberspace, such as AI, IoT, Fintech, robotics, 3D printers, and AR/VR, are becoming established in society,and the unification of cyberspace and real space brings benefits to our lives. At the same time, the risk of
economic and social loss is expected to expand and accelerate exponentially. Due to the evolving methodsof cyber attacks, －organized, sophisticated, and possibly state-sponsored－, it is anticipated that threatsagainst the people's lives would become more serious in the future.

Under these circumstances, sustainable development and assurance of the security in cyberspace, namely,
cybersecurity, are not only essential to fulfill the Growth Strategy, but also extremely important to national

security and crisis management. Especially, As Japan will host major international events, including the

G20 Osaka Summit, the Games of the XXXII Olympiad and the Tokyo 2020 Paralympic Games, it is theupmost necessity, for their success to be achieved, to take all feasible measures to ensure cybersecurity inclose collaboration with international community.

Under the understanding, Japan will aims for sustainable development of cyberspace (Realizing“Cybersecurity Ecosystem”) to realize a society (Society 5.0) where new values and service are generated
continuously, bringing abundance to the people. For that reason, Japan will adhere to its basic position

on cybersecurity presented in the Strategy 2015 and promote public and private sector initiatives oncybersecurity based on three approaches (1. mission assurance for service providers; 2. risk management;
and 3. participation, coordination and collaboration).

Based on this strategy, Japan is determined to firmly take actions to maintain a free, fair and secure

cyberspace in close collaboration with international community. By doing so, Japan will contribute tosocio-economic vitality and sustainable development, build safe and secure society for the people andplay a leading role for maintaining peace and stability of the international community.

It is my sincere hope that the people of Japan as well as the people of other countries will develop a better
understanding of the directions of Japan's cybersecurity policies.

Shinzo Abe

Prime Minister of Japan
Cybersecurity Strategy

01

CONTENTS
Ⅰ. Executive Summary
Ⅱ. Cybersecurity Strategy. INTRODUCTION
1.1. A PARADIGM SHIFT BROUGHT ABOUT BY CYBERSPACE
1.2. CHANGES SINCE 2015

. UNDERSTANDING ON CYBERSPACE
2.1. BENEFITS OF CYBERSPACE
2.2. INCREASING THREATS IN CYBERSPACE. VISIONS AND OBJECTIVES OF THIS STRATEGY
3.1. ADHERENCE TO THE BASIC POSITION ON CYBERSECURITY
3.2. BASIC VISION OF CYBERSECURITY AS A GOAL

. POLICY APPROACHES TOWARDS ACHIEVING. THE OBJECTIVE
4.1. ENABLING SOCIO-ECONOMIC VITALITY AND
4.1. SUSTAINABLE DEVELOPMENT

03
13
14

14
15

17
17
19

21
21

23

26
26

4.1.1 Advancing Cybersecurity as Value Creation Driver26

4.1.2 Achieving a Supply Chain that Creates Values through
4.1-2 Diverse Connections28

4.1.3 Building Secure IoT Systems

30

4.2. BUILDING A SAFE AND SECURE SOCIETY FOR THE PEOPLE

32

4.2.1 Measures for the Protection of the People and Society

32

4.2.2 Protection of Critical Infrastructure through Public and4.2-2 Private Sector Cooperation

33

4.2.3 Strengthening and Improving Security in Governmental
4.2-3 Bodies and Government-Related Entities

36

4.2.4 Ensuring a Safe and Secure Educational and Research
4.2-4 Environment at Universities etc.

38

4.2.5 Initiatives for the Tokyo 2020 Games and Beyond

39

4.2.6 Building an Information Sharing/Collaboration Framework
4.2-6 that Extends beyond Traditional Frameworks

40

4.2.7 Strengthening the Incident Readiness Against Massive
Cyberattacks

4.3. CONTRIBUTION TO THE PEACE AND STABILITY OF THE
INTERNATIONAL COMMUNITY AND JAPAN’S
NATIONAL SECURITY
4.3.1 Commitment to a Free, Fair, and Secure Cyberspace

41

43
43

4.3.2 Strengthening Capabilities for Defense, Deterrence,
4.3-2 and Situational Awareness44

4.3.3 International Cooperation and Collaboration

47

4.4. CROSS-CUTTING APPROACHES TO CYBERSECURITY

49

4.4.2 Advancement of Research and Development

51

4.4.3 Cooperation by Everyone who is the Main Player in Cybersecurity

53. PROMOTION AND IMPLEMENTATION OF. CYBERSECURITY
02

Cybersecurity Strategy

49

4.4.1 Development and Assurance of Cybersecurity Human Resource55

Ⅰ. Executive Summary

Cybersecurity Strategy

03

Summary of theJapan‘s Cybersecurity
Strategy(July 27, 2018 Cabinet Decision)♦New Cybersecurity Strategy is thesecond“basic plan for Cybersecurity”
under the Basic Act of Cybersecurity.
Far-seeing 2020, the Strategy shows
basic position and vision on
Cybersecurity, and objectives andimplementation policies in next 3 years(2018̃2021) domestically andinternationally.

Introduction●A paradigm shift brought about by cyberspace which no human have experienced
before（Society 5.0）
●Increasing seriousness of threats with cyberspace and real space uniﬁcation,necessity of new strategy far-seeing the Tokyo 2020 Games

Understanding
on Cyberspace●Knowledge, technologies, and services in cyberspace, such as Artiﬁcial Intelligence(AI) and Internet of Things (IoT) are becoming adopted in society and bring about
abundance for humanity.
●There is always the latent risk that the providers of these technologies will lose theability to control them. Attacks directed at IoT, critical infrastructure, supply chains,
as well as incidents suspected to have been state-sponsored will increasesocio-economic losses exponentially.

Visions andObjective of
this Strategy●Adherence to the Basic Position on Cybersecurity (Objectives of the Basic Act on
Cybersecurity; Basic Ideals “free,(fair and secure cyberspace”); Basic Principles）●Basic Vision of Cybersecurity as a Goal: Cybersecurity for sustainable development(Promotion of“Cybersecurity Ecosystem”); Three Approaches (1. Mission
Assurance for service providers; 2. Risk Management; 3. Participation, Cooperation
and Collaboration)

Policy Approaches towards Achieving the Objective
Enabling Socio-Economic
Vitality and Sustainable
Development

Building a Safe and Secure
Society for the People

Contribution to the Peace andStability of the Int’l Community
and Japan’s National Security～Advancing Cybersecurity as
Value Creation Driver～～Mission assurance forprotecting people and society～～Commitment to a Free, Fair
and Secure Cyberspace～■Advancing Cybersecurity as Value
Creation Driver■Achieving a Supply Chain that
Creates Values through Diverse
Connections■Building Secure IoT Systems■Measures for the Protection of People and Society■Protection of Critical Infrastructure through Publicand Private Sector Cooperation■Strengthening and Improving Security in
Governmental Bodies and Government-Related
Entities■Ensuring a Safe and Secure Educational andResearch Environment at Universities etc.
■Initiatives for the Tokyo 2020 Games and Beyond■Building an Information Sharing/Collaboration
Framework that Extends beyond Traditional
Frameworks■Strengthening the Incident Readiness Against
Massive Cyberattacks■Commitment to a Free, Fair andSecure Cyberspace■Strengthening Capabilities for
Defense, Deterrence, andSituational Awareness■International Cooperation and
Collaboration

Cross-cutting Approaches to Cybersecurity■Development and Assurance ofCybersecurity Human Resource■Advancement of Researchand Development■Cooperation by Everyone who is
the Main Player in Cybersecurity

related government bodies will keep working on improving their cybersecurity
Promotion and The
capabilities under the leadership of National center of Incident readiness andfor Cybersecurity(NISC), and NISC will play its leading role as the focal
Implementation Strategy
point in coordinating intra-government collaboration and promoting partnershipsof Cybersecurity between industry, academia, and the public and private sectors.

04

Cybersecurity Strategy

Points of【１．
Introduction】&【２．
Understanding on Cyberspace】

The Current Understanding and the Future Image(Increasing Seriousness of Threats with Cyberspace and Real Space Uniﬁcation)

Shift from as of Formulating Current Strategy (Sept. 2015) to Present[(As of formulating the strategy 2015)
Emergence of Interconnected andConverged Information Society][Uniﬁcation of Cyberspace and Real Space]- People and things in real space have become
interconnected to the network, and cyberspace andreal space have become highly integrated. -Real Space (Physical Space)

Real Space (Physical Space)

Smartphone

Healthcare/
Caregiving

Infrastructure(Smart City)(Data Utilization)

Cyberspace
Manufacturing

Finance(Connected
Industries)……

Appliance
Interconnected/
Converged

VehicleUniﬁcation

Cyberspace

Interconnected/
Converged

E-Gov.

(Utilization of Social
Security and Tax
Number System)

Robot(FinTech)Transport(Self-driving
automobiles)

Medium and Long Term

Understanding on Cyberspace
・ While knowledge, technologies, and services in cyberspace, such as AI, IoT, Fintech,robotics, 3D printers, and AR/VR, are becoming established in society and leading
innovations that are transforming the existing structures in socio-economic activities
and the daily lives of Japanese people, there are always the latent uncertainties.

Beneﬁts of Cyberspace

Increasing Threats in Cyberspace- Technologies and services in cyberspace arecontrolled and gaining routine use innumerous domains. They bring about
abundance for humanity.
- The evolution of AI based on deep learning isbringing about changes, it is beginning to be
adopted in a wide range of industries.
- New businesses and services are being
created to utilize the data obtained from IoT
devices.

- There is always the latent risk that theproviders of technologies and services incyberspace will lose the ability to control
them, in which case they can cause
immeasurable economic and social loss ordamage.
- Society will be signiﬁcantly aﬀected wheninterruptions occur to numerous businesses,
functions, and services due to the interruptionof important infrastructural services orunintended behavior by IoT devices, andsituations could even develop to the point of
becoming national security issues.
- Inadequacies in cybersecurity measures are
predicted to directly cause and expand
ﬁnancial damages and losses.

Cybersecurity Strategy

05

Points of【３．
Visions and Objectives of This Strategy】

Basic Vision and Approaches for Cybersecurity○Japan will aims for sustainable development of cyberspace to realize a society (Society 5.0*)
where new values and services are generated continuously, bringing abundance to the people.
○Japan will adhere to its basic position on cybersecurity presented in the Strategy 2015 andpromote public and private sector initiatives on cybersecurity based on three approaches(1. mission assurance for service providers; 2. risk management; and 3. participation,
coordination and collaboration).

※The ﬁfth society in human history following hunting, agriculture, industry and information. New value or service emerge
one after another and generate wealth to subjective people of the society (from Future Investment Strategy 2017)

１．Adherence to the Basic Position on Cybersecurity●Objectives of the Basic Act on Cybersecurity “improve(socio-economic vitality and sustainable development,”“building a safe and secure society for the people,”and“contributing to peace and stability of the international
community and national security”)●Basic Ideals “free,(fair and secure cyberspace”)●Basic Principles ((i) assurance of the free ﬂow of information; (ii) the rule of law; (iii) openness; (iv) autonomy; and(v) collaboration among multi-stakeholders）

2．Advancing Cybersecurity Ecosysteｍ (all actors implement
cybercecurity approaches autnomously)●Mission Assurance●Risk Management●Participation, Coordination, and Collaboration (New Cyber Hygiene)

Basic Vision of Cybersecurity

01

MissionAssurance
Reliable Executionof Operations &Services

02‒Realizing“Cybersecurity Ecosystem”‒

Assessment of Uncertainty& Appropriate Response- Minimizing risks to an
acceptable level byidentifying, analyzing, andevaluating them associatedwith“missions”assigned toorganizations.

Cybersecurity Strategy※Including human resource, equipment, facilities,
network, information systems, infrastructure and supply chain

Cybersecurity for
Sustainable Development

Risk
Management06- Understand the operations or services that should
be carried out as“missions,”and ensure
capabilities and resources* to execute such“missions.”- Each organization should proactively work towards
securing cybersecurity to conduct its“missions,”
without just relying on some experts.

The image of cyberspace evolving
through autonomous initiatives ofall stakeholders mutually impacting
each other will be called the“Cybersecurity Ecosystem”ascompared to a type of ecosystemthat develops sustainably.

03

Participation,
Coordination, andCollaboration(New Cyber Hygiene)
Measures, Coordination &Cooperation by Individuals &Organization from
Peacetime- Fundamental initiatives implemented byindividuals or organizations from peacetime toprevent damages or its escalation possibly
caused by threats in cyberspace.
- Sharing information and mutually coordinationand collaboration between each otherregardless of peacetime or emergency
situations should be regarded as new cyber
hygiene.

【４．
Policy Approaches towards Achieving the Objective】
Points of Enabling Socio-Economic Vitality and Sustainable Development

Enabling Socio-Economic Vitality andSustainable Development
It is necessary in all industrial sectors that consistent cybersecurity measures are carried out toensure corporate business continuity and create new value. In doing so, it is important for thecompanies to implement the measures for which should be handled as part of risk management.

１．Advancing Cybersecurity as Value Creation Driver●Raising executive awareness (from“cost”to“investment”)●Promote companies to actively disseminate and disclose information regarding their cybersecurity initiatives●Promoting the use of insurance in cybersecurity in cooperation with private sectors●Preparing guidelines to support the challenges towards new value creation, risk analysis, and research &development

２．Achieving a Supply Chain that Creates Values through Diverse Connections●Clarifying threats in the supply chain and formulating as well as disseminate frameworks that cut across industrial
categories for implementing operational-level measures●Oﬀering speciﬁc measures of each sector●Promoting initiatives by small and medium-sized enterprises

３．Building Secure IoT Systems●Improving structural framework for IoT systems and international standard●Establishing models regarding measures for vulnerable IoT devices and expanding them overseas throughinternational coordination and standardization

Risk management by executives
Utilize advanced technology

Countermeasures for supply chain

Security by design

Framework for considering risk and measures
System for ensuring the continuous trustworthiness

IoT

AI

Improving structural
framework andinternational
standard
Countermeasures forvulnerabilities

ブロックチェーン
Block
chain

VR

5G
5G

Enhancing cybersecurity business supporting innovation utilizing advanced technologies

Business continuity

Value creation

Cybersecurity Strategy

07

【４．
Policy Approaches towards Achieving the Objective
Points of Building a Safe and Secure Society for the People

Mission Assurance for Protecting People and Society
For the realization of society in which the people can live safely and securely, it is important to ensure multi-layered
cybersecurity, through the coordination of multi-stakeholders, including governmental bodies, local governments,
cyber-related enterprises, critical infrastructure operators, educational and research institutions, and every people
themselves. The government will promote initiatives based on the“mission assurance”approach in order to reducerisks to an acceptable level and ensure that these operations and services are provided safely and continuously.

１．Measures for the Protection of the People and Society●Promoting the policy of“Proactive Cyber Defense”(Promoting the sharing and utilization of threat information,
Providing information of vulnerabilities)●Enhancing measures against cybercrimes

２．Protection of Critical Infrastructure through Public and Private Sector Cooperation●Promoting initiatives based on the Cybersecurity Policy for Critical Infrastructure Protection●Strengthening security in local governments

３．Strengthening and Improving Security in Governmental Bodies and Government-Related Entities●Managing the state of information systems in real-time (Measures based on new common standards)

４．Ensuring a Safe and Secure Educational and Research Environment at Universities etc.
●Implementing practice for each level, and practical training and exercise

５．Initiatives for the Tokyo 2020 Games and Beyond●Promoting the development of the Cyber Security Incident Response Coordination Center

６．Building an Information Sharing/Collaboration Framework that Extends beyond Traditional Frameworks●Promoting information sharing/collaboration between multi-stakeholders

７．Strengthening the Incident Readiness Against Massive Cyberattacks●Strengthening the incident readiness against massive cyberattacks in order to work on risk management for bothcyberspace and real space

Smoothimplementationof theTokyo2020

Building a Safe and Secure Society for the People

Mission Assurance（to provide critical infrastructure services safely and continuously）

Information Sharing/ Collaboration（Cybersecurity Council, Cyber Security Incident Response Coordination Center）

08

Gobvernmental
bodiesLocalgovernments

Critical Infrastructure
operators

Cyber-Related
Enterprises

Educational andResearch Institutions

Promoting risk
management

Improvement andPromotion of the
Safety Principles

Conducting
exercises andtraining

Developmentof Cybersecurity
human resource

Collecting andanalyzing
Information

Cybersecurity Strategy

【４．
Policy Approaches towards Achieving the Objective】
Points of Contribution to the Peace and Stability of the International Community and National Security

Commitment to a Free, Fair, and Secure Cyberspace
A free, fair, and secure cyberspace is essential to contribute to the peace and stability of theinternational community and to Japan’s national security. In order to safeguard a free, fair, andsecure cyberspace, Japan will communicate its position in the international fora, ensureinternational security and promote international collaboration.

１．Commitment to a Free, Fair, and Secure Cyberspace●Communicating the ideas of a free, fair and secure cyberspace (Communicating basic approach to cybersecurity,
Thwart any eﬀorts that aim to inhibit the development of cyberspace)●Promoting the rule of law in cyberspace (Application of existing international law to cyberspace, Contribution to
the development and universalization of norms)

２．Strengthening Capabilities for Defense, Deterrence, and Situational
Awareness●Ensuring national resilience (Mission assurance, Defending Japan’s advanced technologies and defense related
technologies)●Enhancing deterrence capabilities (Measures for eﬀective deterrence, Conﬁdence building measures)●Strengthening cyber situational awareness (Increasing the capabilities of relevant governmental bodies, Threat
information sharing)

３．International Cooperation and Collaboration●Sharing expertise and coordinating policy●International collaboration for incident response●Cooperating for capacity building

Communicating
the ideas of a free,fair and secure
cyberspace
Promotingthe rule oflaw incyberspace

Cooperating
for Capacity
Building

Free, Fair, andSecure Cyberspace
Strengthening
Capabilities for
Defense,Deterrence, andSituational
Awareness

Sharing
Expertise
andCoordinating
PolicyInformation
Sharing / Quick
response of theincidents

Cybersecurity Strategy

09

【４．
Policy Approaches towards Achieving the Objective】
Points of Cross-cutting Approaches to Cybersecurity

Promoting Measures the Cross-cutting
Approaches to Cybersecurity
It is important to work on human resource development and research and development as afoundation for the policy goals from both a cross-cutting and mid- and long-term perspective.

Simultaneously, it is also crucial to promote a cooperative approach in which everyone plays arole in working on cybersecurity as an active agent in cyberspace.

1. Development and Assurance of Cybersecurity Human Resource●Training and adoption at the“strategic management level”●Training for the operational and expert level●Preparing a foundation for development of cybersecurity human resource, Promoting international partnership●Strengthening the assurance and development of cybersecurity human resource at agencies

2. Advancement of Research and Development●Promoting practical R&D (Increasing ability to detect and analyze cyberattacks, and developing a system forcarrying out the necessary technical inspections of malicious programs)●Responses with a view to the mid- and long-term evolution of technology and society

3. Collaboration by Everyone who is the Main Player in Cybersecurity●Developing action plan for public awareness on cybersecurity and coordination/collaboration●Disseminating necessary information (enhancing Cybersecurity Awareness Month)

Raising
Awareness
SeniorExecutives

Establishingroles
Management
strategy
ReportCoordination

Strategic Management Utilization
DirectionLevel
The core support for risk
management regarding
business continuity andvalue creation

Preparing a Foundation for Development of■Concerns for security of products
and services■Explaining to users

Strengthen
trainingIndustry

Schools

Considering andimplementing
the measures

Cybersecurity Human Resource

Government

Collaboration
Cooperation■Information moral education

ReportCoordination

Operational andExpert Level

Community■Building a system that enables
stakeholders to collaborate andcooperate■Disseminating necessary information■Cybersecurity Awareness Month■Autonomous activities

Cultivating awareness and understanding of cybersecurity for each and every people

10

Cybersecurity Strategy

【５．
Promotion and Implementation of Cybersecurity 】

Implementation Framework●The Government has been promoting a policy of improving cybersecurity measures to secure the use andapplication of information and communications technologies and data as the socio-economic foundation ofsociety and to ensure Japan’s national security. the related government bodies will keep working on improving
their cybersecurity capabilities under the leadership of NISC, secretariat of the Cybersecurity Strategy
Headquarters, and NISC will play its leading role as the focal point in coordinating intra-government
collaboration and promoting partnerships between industry, academia, and the public and private sectors.
●The Headquarter will seek to secure and execute the budget necessary for the government so that the measures
are steadily and eﬀectively executed. The Cybersecurity Strategic Headquarters will set forth annual plansincluding the list of Agencies in charge.

CabinetPrime Minister
IT Strategic
Headquarters

National Security
Council (NSC)

Cybersecurity Strategic Headquarters

IT Strategic
Headquarters swiftly
and thoroughly
introduces themeasures for the
Cooperation
formation of anadvanced
information andtelecommunications
network society.

Chair: Chief Cabinet Secretary
Deputy Chair:

NSC deliberates on

Minister in charge of the Tokyo Olympic andCooperation

Paralympic Games
Members:

Chairman of the National Public Safety Commission

important issues
regarding national
defense.

Minister for Internal Aﬀairs and Communications
Minister for Foreign Aﬀairs

Minister of Economy, Trade and Industry
Minister of Defense

Minister in charge of Information Technology Policy

Competent Ministries of
Critical Infrastructures
・ Financial Services Agency
・ Ministry of Internal Aﬀairs
and Communications
・ Ministry of Health, Labourand Welfare・ Ministry of Economy,
Trade and Industry
・ Ministry of Land, Infra,
Transport and Tourism

Relevant
Ministries

Experts (7 persons)CriticalInfrastructure
Expert Panel

Technological
Strategy
Expert Panel

Human Resources
Expert Panel for
Dissemination andEnlightenment

Cybersecurity
Measures
Promotioncommittee

Ministries under
HQ Members

Secretariat

・ National Police
National Center of Incident ReadinessAgency(NISC)
andStrategyfor
Cybersecurit
Cooperation
Cooperation ・ Ministry of Internal・ Ministry of Education,
Culture, Sports, Scienceand Technology (Security
education)

Critical infrastructurebusinesses, etc.

・ Director-General・ Deputy Director-General
GSOC

Government organizations(Ministries, IAAs, DesignatedSpecial Corporations)CYMATCompanies

Aﬀairs andCommunications
・ Ministry of Foreign
Aﬀairs・ Ministry of Economy,
Trade and Industry
・ Ministry of Defense

Individuals

Cybersecurity Strategy

11

12

Cybersecurity Strategy

July 27, 2018
Cabinet Decision

Ⅱ. Cybersecurity Strategy（ Provisional Translation ）Cybersecurity Strategy

13

Introduction
1.1

A Paradigm Shift Brought
About by Cyberspacecyberspace remains this way.
In the near future, the further development ofcomputer science for which cyberspace is a

Cyberspace, with the Internet as a central part ofprerequisite, such as artificial intelligenceits platform, rose out from the rapid development(hereinafter referred to as “AI”), etc. is expectedof digital technology based on modern scientific

to lead to the creation of new products andknowledge, and has continued to expand andservices. The emergence of new products anddevelop globally due to the autonomous

services change peoples’ awareness by changing

1

initiatives of multiple stakeholders, many of

their daily behavior and living environment, andwhich operate in the private sector.

this triggers the transformation of social systems

As a result of its development, cyberspace has

and industrial infrastructures that include existingallowed information and data, diverse in terms ofprocedures, models, organizations, etc. As

both volume and quality, to be freely created,

humanity experiences a paradigm shift fromshared, and analyzed across national borders,hunting society, agricultural society, industrial

unfettered by either time or space. Thus,

society, and information society to “Society 5.0,3”cyberspace actors can potentially generate new

it is necessary to examine the future vision ofvalue by interacting with fellow actors.

cybersecurity whilst taking into consideration

As a result of these characteristics, cyberspace is athese transformations.

place in which intellectual property, such astechnological innovations and new businessmodels can be created, and will continue to serve
as a platform for sustainable development of
economic society. This space also supports
liberalism, democracy, and cultural development,
as well as a place where people can utilize
creation and innovation to significantly expand
their activities.2 In other words, cyberspace is a“frontier for generating infinite value.” Japan will
use all means under its disposal to undertakecybersecurity initiatives in order to ensure that

1

Multiple stakeholders are defined as “the national government, local governments, CII Operators, and Cyberspace-related Business
Entities” in Article 16 of the Basic Act on Cybersecurity. Article 7 of the same Act defines Cyberspace-related Business Entities as“Cyberspace-Related Business Entities (referring to those engaged in business regarding the maintenance of the Internet and otheradvanced information and telecommunications networks, the utilization of information and telecommunications technologies, or
involved in business related to Cybersecurity; the same applies hereinafter).”2

In the Cybersecurity Strategy report (September 2015), the impact of these characteristics on society is compared to the explosion of3

Society 5.0 is the 5th stage of human history, following the hunting society, agricultural society, industrial society, and information

knowledge triggered by Gutenberg’s invention of letterpress printing.
society. It is a society in which new value and new services are created continuously bringing wealth to the people of society.
(Source: Growth Strategy 2017 (Cabinet Decision on June 9, 2017))

14

Cybersecurity Strategy

1.2 Changes Since 2015

should be seen as a single continuously evolvingorganic entity.
The unification of cyberspace and real space

The Cybersecurity Strategy (hereinafter referredsignificantly increases the potential for affording

to as the “Strategy 2015”), enacted by the Cabinet

abundance to society. At the same time, it alsodecision in September 2015 after deliberations byincreases the opportunities for malicious actors

the Cybersecurity Strategic Headquarters

to abuse cyberspace. The risk of economic and(hereinafter referred to as the “Headquarters”)
4social loss or damage in real space is expected toaccording to the Basic Act on Cybersecurity

expand and accelerate exponentially.

(hereinafter referred to as the “Basic Act”) was

Under these circumstances, the security ofcreated as basic policy on cybersecurity-related

cyberspace, which serves as the foundation of

measures covering a period of three years.

economic society, must be ensured, and at theFollowing the formulation of the Strategy 2015,

same time, its autonomously sustained evolution

legal foundation for the utilization of data wasand development has to be ensured in order toprepared, including the Basic Act on theachieve sustainable progress and wealth toAdvancement of Public and Private Sector Data

society, Recently, there has been a trend for5

Utilization and the Amended Act on the
6certain nations to respond to cyber threats byProtection of Personal Information, etc. The

emphasizing management and control by theGovernment has also adopted a policy of realizing

state from a dominant position. However, the7an anthropocentric society that achieves bothstrengthening of management and control of

economic development and resolution of social

cyberspace by the state has the effect of hindering

issues through the high level of integration of

the possibility of autonomous and sustainablecyberspace with real space. Under thesedevelopment. Thus, the cyberspace of today thatcircumstances, massive amounts of data

developed through the autonomous initiatives ofgenerated by sensors and devices in real space are

all stakeholders must be respected, andcurrently being accumulated and analyzed incybersecurity must be secured throughcyberspace. Furthermore, the provision in realcollaborative and cooperative initiatives withspace of new products and services that adds

those stakeholders.

value through use of data can be seen cyclically

Based on this understanding, mindful of the state

emerging and developing in numerous domains.

of affairs to be pursued for 2020 and beyond andNo longer does cyberspace and real space exist as

taking into consideration the hosting of such

independent entities, but as mutually interacting

international events as the Games of the XXXII

entities, such that they cannot be considered

Olympiad and the Tokyo 2020 Paralympic Games

separate anymore. Therefore, the two spaces(hereinafter referred to as “the Tokyo 2020

84This Basic Act was enacted on November 6, 2014. It afforded a legal position for the concept of cybersecurity and clarified the5This Act was enacted on December 7, 2016. It stipulates basic principles on the promotion of private sector data utilization.

6

This revised Act was enacted on September 3, 2015, and came into full effect on May 30, 2017. This Act was established to promote

7

Contents of Society 5.0 (Source: Comprehensive Strategy on Science, Technology and Innovation 2017 (Cabinet Decision on June 2,

8

The “Sustainable Development Goals (SDGs)” adopted at the United Nations Summit in September 2015 established 17 goals forresponsibilities of the various stakeholders.

anonymization as a precondition before the utilization of personal information.
2017), Investment for the Future Strategy (Cabinet Decision on June 9, 2017).
achieving a sustainable global society and a society in which “nobody is left behind.” There are several points shared between thepolicy for cybersecurity initiatives here and the SDGs, such as aiming for sustainable development and initiatives based on thecooperation and collaboration between all stakeholders.
Cybersecurity Strategy

15

Games”), Japan will spare no efforts regarding
cybersecurity measures by clarifying the basic visionof cybersecurity, identifying new issues that need tobe tackled; and swiftly implementing measures.
This strategy clarifies the basic position andapproach to cybersecurity taken by Japan moving
forward, while clearly indicating both
domestically and internationally the goals andimplementation policies of the various measures
for the next three years in order to serve as thebasis for shared understanding and action.

16

Cybersecurity Strategy

Understanding on Cyberspace
Knowledge, technologies, and services incyberspace, such as AI, IoT,9 Fintech,10 robotics,
11

2.1

12

3D printers, and AR/VR, are becoming
established in society and leading innovations

Technologies and services in cyberspace arethat are transforming the existing structures ingaining routine use in numerous domains. The

socio-economic activities and the daily lives ofcontinued sustainable development of cyberspace

Japanese people, and these transformations areis expected to bring about abundance forbringing about progress in the unification ofhumanity.

cyberspace and real space.

13

In order to create this strategy, an accurate
understanding of the benefits afforded bycyberspace and the state of the threats in that

[1] Advancements in Services in
Cyberspace and the Adoption
thereof by Society

space must be considered to be prerequisites.

The number of Internet users in Japan is rising, as

Furthermore, in order to enjoy the benefits of thehas the spread of the Internet itself.14

knowledge, technologies, and services ofFurthermore, in terms of devices, the rate ofcyberspace, it is essential to control the latentpersonal smartphone ownership has increased

uncertainties always therein. When such control

significantly,15 and the Internet usage rate is also

is not possible, the potential exists forrising.16 The ratio of social media users is also

cybersecurity related threats to increase rapidly.

rising,17 as a result of which an environment now
exists for easily communicating in cyberspace.
The increasing adoption of services in cyberspaceby society has promoted not only the free flow of
information, but also the formation of diverse

9Abbreviation of Internet of Things.

10

A portmanteau combining the words finance and technology. It refers to new innovative financial services using new technologies
such as the blockchain, big data, and AI, carried out through such devices as smartphones and tablets that have rapidly spread towide adoption (Source: WHITE PAPER 2017 Information and Communications in Japan).

11

Compared to printers that output a flat (two dimensional) image to paper, a 3D printer forms three dimensional objects using three12

Abbreviations of augmented reality and virtual reality.

13

Strategy 2015 states that “physical objects and people in real space have become interconnected in a multi-layered manner without

dimensional data from 3D CAD and 3D CG (Source: Website of the Japan 3D Printing Industrial Technology Association)

physical constraints, by harnessing the free flow of information and accurate data communications in cyberspace. Due to suchlinkages, there is an emergence of an “interconnected and converged information society” where real space and cyberspace havebecome highly integrated.”
14

Internet penetration rate among the general population (82.8% as of the end of 2014 rose to 83.5% as of the end of 2016) (Source:

15

Personal smartphone ownership rate (44.7% as of the end of 2014 rose to 56.8% as of the end of 2016) (Source: WHITE PAPER 201716

Internet usage rate (83.0% as of the end of 2015 rose to 83.5% as of the end of 2016) (Source: WHITE PAPER 2017 Information and

17

Trend in use rates for representative SNS services (LINE, Facebook, Twitter, mixi, Mobage, GREE) (total) (62.3% as of the end of

WHITE PAPER 2017 Information and Communications in Japan)
Information and Communications in Japan)
Communications in Japan)
2014 rose to 71.2% as of the end of 2016) (Source: WHITE PAPER 2017 Information and Communications in Japan)
Cybersecurity Strategy

17communities and the sharing of information.

to be bringing about changes comparable to the

There has been progress in the area of financial

Cambrian explosion in the world of machines andactivities as well, including online shopping, stock

robotics.19 Deep learning has enabled the design

trading, and online banking, while new services inof feature extraction20 used in differentiation andthe areas of Fintech and the sharing economy18

identification, a task that previously had to be

are appearing regularly and leading innovation.

carried out by a human in standard machine

There has also been progress in the use oflearning, to be carried out automatically by

information and communication technology incomputers, and this is considered an evolutionary

medicine and nursing, welfare, education andstep for AI. Furthermore, a world in which AI isother areas related to social issues such as theable to autonomously generate output resulting

declining working-age population and the aging

in creative works, such as music, paintings, andof local communities.

novels, and self-driving services (for example
results from determination, decision making, and[2] Dramatic Evolution of AI

proposal) without any creative contribution by

With respect to AI, there have been recent

humans. The possibility has also been pointed

advancements in computer science, and inout regarding who would be responsible if AI

research on machine learning which requires

were to infringe rights or cause accidents.21

massive quantities of data, giving rise to the new

These developments in AI will lead to theapproach of deep learning. The emergence of

emergence of entirely new products and services,

deep learning has accelerated the optimization

and bring about changes in people’s daily

and increase in quality of numerous functions inbehavior and living environment in the future.

socio-economic activities, including a significant

This will cause changes in the way that humans

increase in the precision of AI based image

perceive the world, which is expected to promoteanalysis, and increased precision in productthe transformation of existing social systems andanomaly detection, cancer diagnosis, investment

industrial structures.

decisions, and translation, and this technology is
beginning to be adopted in a wide range of[3] Development of IoT

industries. Similarly, in the area of cybersecurity

The reduction in size, weight, and cost of sensors

this potential of AI is also beginning to see use in

has enabled an explosive spread in IoT, in which

the various measures such as the automation of

all things become connected to the network. In

malware detection.

addition to the use of things such as home

The evolution of AI based on deep learning is said

appliances, automobiles, robots, and smart

18

Economic revitalization activities in which personally owned assets that can potentially be used are made available for use by other

19

The Cambrian explosion is the phenomenon by which the phylum of animals existing today arose suddenly between 542 million

individuals via online matching platforms (Source: WHITE PAPER 2017 Information and Communications in Japan)
and 530 million years ago. Paleontologist Andrew Parker has presented the theory that the emergence of vision caused the
explosion. Deep learning enables vision for AI. This enables AI to predict what will happen next and take action. Thus, it means the
emergence of machines with eyes, and suggests that the equivalent of a Cambrian explosion will occur in the world of machines androbotics (Source: Headquarters for Japan’s Economic Revitalization, the Fourth Industrial Revolution Conference to Promote Human
Resource Development (2nd Meeting) Document 1)
20

A quantitative expression of the important characteristics requiring attention when recognizing an object. Before the arrival of deeplearning, features were designed by humans. However, deep learning enables computers to carry out feature extraction on their own
using image and sound recognition. (Source: WHITE PAPER 2017 Information and Communications in Japan)

21 “In the future, the problem might arise of whether users may be held responsible if the user (human) involvement with respect tothe output of the AI product decreases.” Intellectual Property Strategy Headquarters “Committee to Review Intellectual Property
Regarding New Data-related Assets (Report)” (March 2017).

18

Cybersecurity Strategy

meters, new businesses and services are being
created to utilize the data obtained from IoT
devices.

Increasing Threats in

2.2 Cyberspace

Specifically, efforts are being made to improve

While AI and IoT technologies and services haveproductivity and afford high added value in thethe potential to bring many benefits to people,

areas of e-government, smart cities,

there is always the latent risk that the providers of

manufacturing, self-driving automobiles, finance,these technologies and services will lose the22

health and medicine, and nursing, and theability to control them, in which case they canutilization of data is expected to progress in thecause immeasurable economic and social loss or23

various supply chains for those domains.

damage. As the unification of cyberspace and real

Furthermore, there has been progress in so-called

space proceeds, the likelihood that such severe

24

open innovation in which cooperation occurs

effects occur increase exponentially. Furthermore,across domains via cyberspace, and new services

cyberspace is a place unrestricted by space orare expected to emerge continuously thattime where anyone, including malicious actors,

generate more abundance for people through the

can misuse and abuse new information andsharing and analysis of data.

communication technologies to act with ease. In
addition to the ability for malicious actors andgroups of such actors to easily copy and distributedata and information, including attack programs,
which is due to the very nature of digitaltechnology, they can also flexibly incorporate andmake free use of developing technologies such as
AI and the blockchain.25 For that reason, theattackers have an asymmetrical advantage overthe defenders, and that advantage is expected toincrease particularly when the defender’sformation depends on existing policies andtechnological systems.
Given these conditions, attacks26 directed at IoT,
Fintech including cryptcurrencies, critical

22

The Declaration to Be the World’s Most Advanced Digital Nation / Basic Plan for the Advancement of Public and Private Sector Data
Utilization (Cabinet Decision on June 15, 2018) defines eight priority fields (electronic administration; health, medical, and nursing
care; tourism; finance; agriculture, forestry, and fisheries; manufacturing; infrastructure, disaster management, and disaster
reduction; and mobility) expected to help solve issues such as (1) economic revitalization and the restoration of financial health, (2)regional revitalization, and (3) ensuring the safety and security of the lives of the people by promoting public and private sector
data utilization.

23

The supply chain refers to the flow of goods and information in business activities from upstream to downstream, from the receiving

24Open innovation refers intentionally and proactively utilizing the flow of internal resources, such as technologies and ideas, in andand placing of orders between suppliers and the procurement of materials to inventory management and product delivery.
out of the organization to promote internal innovation, and deploying the resulting internal innovations outside the organization toincrease market opportunities.
25

Referring to blockchain technology. It uses a data structure in which modification can be detected easily by using digital signaturesand hash pointers. By storing the relevant data on multiple nodes distributed throughout the network, the technology achieves highdata availability and integrity. (Source: Japan Blockchain Association, “Blockchain Definition”)

26

The Bangladesh Bank was hacked, resulting in the unauthorized wiring of approximately 81 million dollars. A new type of malware(Mirai) emerged in September 2016, infecting IoT devices to cause the largest DDoS attack in history. A cyberattack also occurredon the transformer stations of a state operated power company in Ukraine in December 2016.
Cybersecurity Strategy

19both inside and outside Japan, causing direct[2] Reduced Competitiveness Due tothe Loss or Breach of Information

financial losses and the interruption of businesses

With the explosive spread in IoT and theand services in addition to the usual data breach,increasing practice of making data publicly

and serving to threaten the safety and security ofavailable, new services that use data will continue

the sustainable development of socio-economic

to increase in number. There will also be progress

activities and the people’s living. There have also

in the use of AI for data analysis. Data used forbeen massive incidents suspected to have been

deep learning is directly related to thestate-sponsored. There is also the concern that

performance of the AI. As the importance of datacredibility of the information infrastructure may

continues to increase, damage to the authenticity27

be shaken if a cyberspace is controlled andor integrity28 of the data will undermine trust in

managed by some countries from a superior

the services that use the data.

position.

In addition to being subject to claims for

It is believed that as cyberspace continues tocompensation for loss or damages, the data

become further unified with real space, there will

breach, such as personal information, trade

be increased concerns over potential attempts tosecrets, and other valuable data, can also invite atarget weaknesses in IoT, supply chains, and open

fall in the reputation and trust an organization or

innovation, and for unintended behavior to occur

company receives from society. Once breached,in these systems. It is expected that serious

such data can never be taken back, and can lead

impacts may occur not only for governmental

directly to a drop in the competitiveness of thebodies and critical infrastructure operators, butorganization or company.

infrastructure, and supply chains have occurredfor other businesses and even individuals.

[1] Major Effects on Society Due toInterruptions to Business, Functions,and Services[3] Loss from Financial Theft and Fraud
Incidents have occurred in which inadequacies inbasic measures for cybersecurity have led tounauthorized access to virtual currency exchange

Society will be significantly affected when

operators and massive financial damages throughinterruptions occur to numerous businesses,

business email compromise. As socio-economic

functions, and services due to the interruption ofactivities are expected to grow more and more

important infrastructural services or unintended

dependent on cyberspace, inadequacies inbehavior by IoT devices, and situations could

cybersecurity measures are predicted to directly

even develop to the point of becoming nationalcause and expand financial damages and losses.

security issues. If the unification of cyberspaceand real space continues to progress further,
contingencies may occur that threat the safety
and security of the people and the very roots ofdemocracy and the state, including the disablingof the functions of society and risks to human lifeand livelihood.

27

A characteristic that ensures an actor or resource is as claimed.

28

The information has not been damaged, modified, or deleted.

20

Cybersecurity Strategy

Visions and Objectives ofthis Strategy
The visions and objectives of this Strategy are[2] Basic Ideals

clarified below as the firm maintenance of Japan’s

The basic ideals to which Japan will adhere tobasic position on cybersecurity, and in light ofcontribute to the objectives of the Basic Act is tosuch position, “the basic vision of cybersecurity”

aim for a “free, fair and secure cyberspace.” Suchunder the current understanding of cyberspacea cyberspace means a secure cyberspace in which

and its future image.

the freedom of expression and economic activitiesof all actors active therein is guaranteed without

Adherence to the Basic
3.1 Position on Cybersecurity

any discrimination or exclusion with no justifiablereasons, and where unlawful activities such as thetheft of information or assets are not allowed.

Japan will adhere to its basic position on
cybersecurity including the “objectives of the[3] Basic Principles

Basic Act on Cybersecurity” and the “basic ideas

The five principles stipulated by the Strategy

and principles” presented in the Strategy 2015.

2015 as the basic principles to adhere to for

On that basis, in order to continue to deter

developing and implementing cybersecurity

malicious actors’ activities and guarantee people’smeasures are: (i) assurance of the free flow ofsafety and rights, Japan retains, as its options,information; (ii) the rule of law; (iii) openness;

political, economic, technological, legal,(iv) autonomy; and (v) collaboration among

diplomatic, and all other viable and effective

multi-stakeholders.

means.

(i) Assurance of the Free Flow ofInformation[1] Objectives of the Basic Act on
Cybersecurity

For the sustainable development of cyberspace as

The Basic Act aims to “improve socio-economica place for creation and innovation, it isvitality and sustainable development,” “building aimperative to build and maintain a world in whichsafe and secure society for the people,” andtransmitted information reaches the intended“contributing to peace and stability of therecipient without being unfairly censored or
29international community and national security. ”

illegally modified en route.30 Consideration forThis strategy also arranges policy goals within

privacy must also be maintained. As a basic

these three areas in order to promote measurescondition for the free flow of information in cyberaccordingly.

space, morality and commonsense are requested

29

Article 1 of the Basic Act stipulates that “the purpose of this Act is to comprehensively and effectively promote the cybersecurity
policy ... and as a result, attempting to enhance economic and social vitality, sustainable development and realizing social
conditions where the people can live with a sense of safety and security, and contributing to the protection of international peaceand security as well as national security.”

30

Article 1 of the Basic Act stipulates“to ensure the free flow of information ... simultaneously.”
Cybersecurity Strategy

21not to offend rights and interests of others.

will promote this approach.32(ii) The Rule of Law
As the unification of cyberspace and real space(v) Collaboration among Multistakeholders

progresses, the rule of law should also be

Cyberspace is a multi-dimension world

maintained in cyberspace in the same way as inestablished through activities of multi-

real space. Various domestic rules and norms,

stakeholders, including the state, local

including domestic laws and regulations, aregovernments, critical infrastructure operators,

applied in cyberspace. Similarly, existing

cyber-related and other businesses, educationinternational law is also applied in cyberspace.

and research institutions, and individuals. For the

Application of existing international law andsustainable development of cyberspace, all actors

development of norms continue to be essential

are required to consciously fulfill their respective

for sustainable development of cyberspace as aroles and responsibilities. To do so, coordination

safe and reliable space.

and collaboration is required in addition toindividual efforts. States have the role of(iii) Openness

promoting this coordination and collaboration,

In order to achieve the sustainable development

and will promote measures enabling theof cyberspace as a space to generate new values,

fulfillment of such roles.33

cyberspace must be open to all actors without
restricting possibilities of linking diverse ideas
and knowledges. Japan adheres to the position
that cyberspace must not be exclusively
dominated by some a certain group of actors
therein.31(iv) Autonomy
Cyberspace has developed through theautonomous initiatives of multi-stakeholders. It is
inappropriate and impossible for a state to takeon the entire role of maintaining order forcyberspace to sustainably develop as a space
where order and creativity coexist. The only
approach to deter and address malicious actors’
behavior to maintain order in cyberspace is forvarious social systems to achieve their missions
and functions autonomously. The Government

31

Article 3 of the Basic Act on the Formation of an Advanced Information and Telecommunications Network Society stipulates that“every people has an opportunity to easily and independently use the Internet and other advanced information andtelecommunications networks.”

32

Article 3 Paragraph 2 of the Basic Act stipulates that “The promotion of the Cybersecurity policy must be carried out with the intent
to raise awareness to each member of the public about Cybersecurity and encourage each member of the public to take voluntaryactions.”

33

Article 3 Paragraph 1 of the Basic Act stipulates that “(Cybersecurity policy) must be carried out with the intent to produce active
responses to threats against Cybersecurity through coordination among multiple stakeholders.”

22

Cybersecurity Strategy

3.2

Basic Vision ofCybersecurity as a Goal

Based on Japan’s idea mentioned above, thefollowing presents the desired outcome thatcybersecurity initiatives must aim for and threecompared to a type of ecosystem that develops
sustainably.

[2] Three Approaches(i) Mission Assurance for Service
Providersapproaches required to promoting such initiatives

Reliable execution of operations and services

as the “basic vision of cybersecurity.”“Mission Assurance” refers to the condition inwhich any organization represented by[1] Goalcompanies, critical infrastructure operators, and34

Japan aims to realize a society in whichgovernment bodies understand the operations or

cyberspace develop sustainably as “frontier

services that they should carry out as theirgenerating infinite values,” where new values and“missions,” and ensure necessary capabilities andservices are generated continuously, bringing

resources to reliably execution such “missions.”

abundance to the people.

As part of that assurance, it is vital, from the

In order to contribute to the realization of suchstandpoint of each organization carrying out theirsociety, cyberspace must develop throughoperations or services as “missions,” for thoseparticipation of all actors in generating new

responsible in each organization to proactively

values. To support this sustainable development,

work towards securing cybersecurity without

all actors are required to be aware of their own

relying on some experts.

roles with regard to cybersecurity and implement

In other words, this means that senior executives

cybersecurity approaches autonomously, just likeor managers of each organization should identify

the immune systems of living things.

operations or services that represent their

With such perspectives, the government will

“missions” and take all responsibility for secure

implement the following initiatives in order toand sustainable provision, rather than making

promote cybersecurity initiatives.

cybersecurity initiatives themselves the goal.

Specifically, we will promote public and private
sector initiatives on cybersecurity based on three(ii) Risk Management

approaches (1. mission assurance of service

Assessment of Uncertainty and Appropriate

providers; 2. risk management; and 3.

Response

participation, coordination and collaboration)“Risk management” means to minimize risks towith the aim of autonomous and sustainable

an acceptable level by identifying, analyzing, andevolution and development of reliable cyberspaceevaluating risks35 associated with “missions”

while realizing both security and economic

assigned to organizations. The innate uncertainty

development in cyberspace.

of cyberspace unavoidably leads to this

The image of cyberspace evolving this way

viewpoint.

through autonomous initiatives of all

Risk is defined as “the effect of uncertainty on

stakeholders mutually impacting each other will

objectives,”36 and measurable only by considering

be called the “Cybersecurity Ecosystem” asthe established objectives. Therefore, evaluation

34

This refers to Society 5.0 (Sources: Comprehensive Strategy on Science, Technology and Innovation (STI) for 2017 (Cabinet
decision on June 2, 2017), Growth Strategy 2017 (Cabinet decision on June 9, 2017)).

35

Note that this refers to uncertainty that has both positive and negative aspects.

36

Definition given by the International Organization for Standardization (ISO)Cybersecurity Strategy

23

of or response to risks differs depending on

individuals and organization from peacetime

objectives of the organization. Furthermore, risk

“Participation, coordination and collaboration”

37

management is defined as “coordinated set of

applies to fundamental initiatives implemented

activities and methods that is used to direct an

by individuals or organizations from peacetime toorganization and to control many risks that can

prevent damages or its escalation possibly caused

affect its ability to achieve objectives,” and thus

by threats in cyberspace. Any actor operating inrepresents the overall set of activities ofcyberspace may potentially create new values as

addressing risks through directing and controlling

their benefits, but they may also be exposed toorganizations and appropriately distributing

threats emerging from inherent risks. From thisorganization’s limited resources, which is not thestandpoint, it is necessary for not only

individual activities of identifying, analyzing ororganizations providing services but also

evaluating risks.

individuals to take day-to-day basic cybersecurity

If each organization underestimates risks without

efforts from peacetime.

acknowledging operations or services which

Specifically, this includes measures to protect

represent its “mission” and does not allocate

against malicious programs, mitigate

necessary resources to cybersecurity, it may leadvulnerabilities,38 secure reliability of certifications,

to contingencies that can threaten the very

and manage personal information properly,

survival of the organization. On the other hand, if

among other things. These initiatives are often

the risks are overestimated and excessive

compared to public hygiene activities orresources are allocated to cybersecurity, it could

transportation safety campaigns carried out in

impede the execution of organization’s operations

real space.

or services and its sustainable growth.

However, while cyberattacks may occur anytime

Such an approach to risk management isor anywhere and threats become a daily concern,necessary for all, even individuals, who enjoy theit is difficult to respond through individual efforts

benefits of utilizing knowledges, technologies oralone, and proactive support by otherservices of cyberspace.

stakeholders including organizations, is required

When enjoying benefits, it is common for risks of

to strengthen such initiatives.

losing control of prerequisite technologies or

For this reason, it is necessary for everyone toservices to emerge. Accordingly, since mechanicalwork on initiatives together, which means they

prediction does not hold, and it is impossible tomust cooperate. In addition to working on

eliminate the risk completely, we need toindividual initiatives, it is necessary for every

properly address such risks according to theindividual or organization involved in cyberspacenature or manifestation of each risk, andto share information and mutually coordinate

minimize cybersecurity risks at an acceptable

and collaborate between each other regardless oflevel in counterbalance with the merits of services

peacetime or emergency situations. These basic

and products provided thereof.

cybersecurity efforts should be regarded as new
cyber hygiene.

(iii) Participation, Coordination, andCollaboration

Measures, coordination and cooperation by

Accordingly, we need to support through publicprivate partnership to promote such fundamental
initiatives. Particularly, under the principle of37

Definition given by the International Organization for Standardization (ISO)38

People, things, and flaws in services that trigger threats.

24

Cybersecurity Strategy

“collaboration among multi-stakeholders” listed
under the Basic Principles, Japan must proactively
carry out the role of promoting collaboration andcoordination on a daily basis.

Cybersecurity Strategy

25

Policy Approaches towards
Achieving the Objective
The following are the targets and guidelines of

to ensure corporate business continuity andthe policies scheduled to be implemented in thecreate new value, and to promote thosecoming three years, for delivering results of theinitiatives.

strategy. Each policy is expected to be consistentIn doing so, it is important to understand thatwith the following three approaches described incybersecurity related risks are one type of risks

Japan’s Idea on Cybersecurity and the Basic Vision

enterprises are facing and that measures shouldof Cybersecurity.

be handled as part of risk management. In
addition, these measures should take root in

Enabling Socio-Economic
4.1 Vitality and Sustainable
Development

organizations naturally according to the situationof each industry and business.

[1] Raising Executive AwarenessEnterprises are improving productivity of their

It appears the majority of business leaders arebusiness with active use of digital devices, such as

still obsessed with an idea that cybersecurity

personal computers and smart phones, and themeasures bring no profit for their business. This

Internet. Such technologies are also utilized tobelief may come from an idea that cyberattack

introduce business innovation, leading-edge

preparedness is nothing more than an unwanted

services, and other new values. Cybersecurity“cost,” since cyberspace is supposed to be offeredmeasures should be regarded as “investments” asfor free without any precaution, and thatthe basis to drive those trends, rather thancyberattacks to damage their business seldom

unwanted “costs.” Consistent cybersecurity

happen. As the use of cyberspace grows rapidly,

measures bring about industrial growth andhowever, enterprises should understand that

global competitiveness, and are critical for Japan’s

threats exist precisely because of this freedomsocio-economic vitality and sustainable

and be prepared against them. Enterprises may

development.

find cybersecurity measures are difficult to adopt
without organization-wide discussion to define

Advancing Cybersecurity
4.1.1
as Value Creation Driver

their importance. Raising executive awareness isEnterprises will face even higher cybersecurity

measures are indispensable investments forrisks along with the integration of cyberspace andensuring business continuity and value creation,

real space. Cybersecurity awareness is increasing

but not inevitable costs.

among a few industrial sectors and larger

Specifically, senior executives are expected toenterprises. Going forward, it is necessary in all

actively engage in cybersecurity throughindustrial sectors to spread the understanding

executive meetings and should acquire a certainthat cybersecurity initiatives must be carried out

level of knowledge and skills for risk management

26

Cybersecurity Strategy

essential as they are expected to play evangelisticrole in penetrating thoughts that cybersecurity

in cybersecurity affairs. However, requiring in-perspective, senior executives understand thedepth technical knowledge and skills to seniorstate of affairs and study and implement further

executives may not be quite realistic. Therefore,

specific measures necessary, the market positively

enterprises need to secure human resources (orevaluates those initiatives as efforts that lead to“strategic management level”) who are capable

more corporate value, and incentives forto grasp cybersecurity risks in the contexts ofcybersecurity investment are continuously

management and business strategies, plan

generated.

cybersecurity measures in line with executive

To this end, it is important for companies topolicies, and lead both business and technicalactively disseminate and disclose information

personnel. Senior executives should build up

regarding their cybersecurity initiatives. The

appropriate risk management schemes for thegovernment will share information on best

entire supply chain, covering both their own andpractices and create guidelines while working oncontractor organizations. Senior executives also

the continuous grasping and evaluation of theshould be accountable to shareholders forstate of information dissemination and disclosure.

benefits and risks of business enabled by

In addition, it is necessary to go forward on the

cyberspace.

creation of a framework for investors to evaluate

Given this situation, the government will work incybersecurity initiatives from corporate

cooperation with private sectors to discover andmanagement.

train personnel who are capable of explaining andRegarding measures aimed at enterprises todiscussing cybersecurity measures with seniorpromote cybersecurity, the government will

executives while hosting seminars for senior

follow up on the use of incentives for investment

executives to promote a change in thinking. The

in cybersecurity so that they function effectively,

government will also promote policies to appeal

and consider required measures as necessary.

the importance of cybersecurity measures toFurthermore, the use of insurance is on the rise as

senior executives in an easy to understanda risk management approach to cybersecurity.

manner. These policies include theThis may make it easier to promote investment

encouragement of declarations regarding

because the cost of preparing for risks will becompany initiatives and the development of tools

clarified by the system in which insurance

to visualize measures to make comparisons withpremiums are appropriately calculated according

measures taken by similar companies. The

to the implementation status of cybersecurity

government will also work with academia tomeasures. Based on this understanding, theorganize various legal systems that enterprises

government will consider measures for promoting

should refer to when implementing their

the use of insurance in cybersecurity incybersecurity measures.

cooperation with private sectors.

[2] Stimulating Cybersecurity[3] Enhancing Cybersecurity Business

Investments

Corresponding managerial incentives are

Supporting Innovation Utilizing
Advanced Technology

important for ensuring companies to implement

The use of advanced technologies, such as IoT,

cybersecurity initiatives on a continuous basis.

AI, VR, the blockchain, and next-generation

Specifically, a virtuous cycle is desirable in whichtelecommunications technologies, is often

cybersecurity risks and associated measures are

essential for enterprises to create new values. At

made visible including those from a financial

the same time, the use of these technologies
Cybersecurity Strategy

27

presents new vulnerabilities that previously did

services that support the use of those advanced

not exist, and malicious use of such technologies

technologies.

may also lead to unexpected risks. For that

Furthermore, in order to promote international

reason, there are expectations for realizing highadoption of Japan’s products or services that havequality products or services related toachieved high levels of cybersecurity, thecybersecurity by estimating the risks beforehand

government will promote the benefits of suchand including cybersecurity measures in the

products or services through sales promotion byprocesses of creating those products or services

top government officials and trade shows. It will(security by design). Furthermore, these

also work on the development of a businessinitiatives will lead not only to improved trust forenvironment that facilitates international

Japan’s products or services, but also to promoting

adoption by taking strict action throughthe overseas deployment of high quality

international cooperation against measuresinfrastructure that Japan is striving towards.

inhibiting free trade in the name of cybersecurity.

Meanwhile, due to a lack of expertise incybersecurity, it may not be possible forenterprises to move forward with such initiatives
easily despite their intent to do so. In addition, it
is necessary from the perspective of enhancing

Achieving a Supply Chain that
4.1.2 Creates Values throughDiverse Connections

international competitivity, and avoiding relianceAs unification of cyberspace and real space

on security products or services in which

accelerates, previously nonexistent trade between

authenticity and reliability are difficult to verify.

different industries and enterprises is occurring

Therefore, there is a need to strengthen

on a global scale as we move towards Society 5.0.

cybersecurity businesses that provide specificFurthermore, diverse and fluid forms that go

solutions domestically.

beyond the traditional supply train are emerging,

To meet these needs, the government will support

such as the automation of trade. Given these new

the challenges towards new value creation using

forms, cybersecurity issues that occur at the edge

such advanced technologies not only by majorof these connections of supply chains have theenterprises but also venture enterprises.

potential to spread more broadly than before andSpecifically, the government will work incause massive negative effects not only to realcooperation with private sectors to analyze andspace but to the entire socioeconomic activities.

clarify cybersecurity risks associated with the use

It is essential to be aware of these risks and toof advanced technologies and to prepare andpromote initiatives that take the entire supply

disseminate guidelines based on such analysis

chain into consideration.

and clarification. In addition, the government will
promote research and development on risk
analysis and threat countermeasures for advanced[1] Formulating Cybersecurity

Framework for supply chain risk

technologies required for these initiatives. It is

As the supply chain connections take more

important to place the concept of security by

diverse and fluid forms, it is essential for ensuring

design at the foundation of these initiatives. The

cybersecurity to implement consistent measures

government will also deliberate the building offor the overall supply chain. It is also expected

systems to match enterprises aiming to createthat the quality of products or services will givenew values using advanced technologies withrise to new value creation through theseproviders of cybersecurity technologies orimplementations.

28

Cybersecurity Strategy

Specifically, the government will work inhas been proven so that suppliers in the supply

cooperation with private sectors to clarify threats

chain can verify that trustworthiness when using

in the supply chain and formulate as well as

devices or equipment. The government will also

disseminate frameworks that cut across industrial

consider a system to verify traceability and a

categories for implementing operational-levelsystem to detect and prevent attacks on themeasures. In order for business operators

generated trust itself so that these become

including small and medium-sized enterprises tocontinuous systems within the connections of theimplement the measures easily, adequate

supply chain.

consideration will be given to ensure that thefeasible and easy to understand, in light of[3] Promoting Initiatives by Small andMedium-Sized Enterprises

situation of their circumstances. It is also

When small and medium-sized enterprises suffer

important to ensure that business operators canfinancial damages and decline in trust due tobe aware of the balance between risks and costs

cyberattacks, impact on operations can be greaterof countermeasures.

than for major enterprises. There are also

It is necessary to offer specific measures of eachconcerns that small and medium-sized

sector required for IoT devices or organizations

enterprises can be used as footholds forwith an awareness of connections, areas requiringexpanding the impacts of cyberattacks from theprotection, and differences in threats related tocompany to its business partners. Meanwhile,the supply chain in each industry sector.

cybersecurity measures must be promoted with

Furthermore, as the supply chain expands

the understanding that small and medium-sizedglobally, it is necessary to reflect overseas trends

enterprises do not necessarily possess high levelin the development of relevant rules so thatknowledge or skills in cybersecurity, and it may

cybersecurity measures based on Japan’s security

be difficult for them to adequately invest inframeworks will be recognized globally.

cybersecurity.

contents of the guideline are both realistically

For that reason, the government will prepare[2] Building a System to Confirm
Cybersecurity in the Supply Chaineasy-to-understand case studies of cybersecurity

Securing the trustworthiness of the elementsthat include models for the safe use ofcomprising the supply chain including devices

information systems, and will promote the use ofbeing manufactured, the data generated andinsurance in cybersecurity. The government will

distributed in devices, and the services that use

also strengthen the consultation system for smallthem is essential in securing cybersecurity for theand medium-sized enterprises on cybersecurity

overall supply chain. To that end, it is necessary

incidents. Furthermore, the government will

for the government to work to clarify thepromote visibility initiatives in cooperation withrequirements and build a system that generates

private sectors for small and medium-sizedtrust by certifying that such requirements areenterprises working on cybersecurity to promotemet. Consequently each element will be createdtheir efforts to the public on their own initiative.

and distributed in a way that meets security

The initiatives will include a systems to enablerequirements. It is also necessary for thethem to carry out their cybersecurity efforts

government to work with the private sector toeffectively coordinated with incentive programs.

measures for small and medium-sized enterprises

build a system to create and manage a list ofdevices and services for which trustworthiness
Cybersecurity Strategy

29

4.1.3 Building Secure IoT Systems39

these initiatives, the government will work to

The number of devices connected to cyberspaceeach stakeholder in public and private sectors in ais rapidly expanding, and cybersecurity measuresmanner that provides an overall picture, and buildfor vulnerable things, which can negativelya system for sharing information. These initiatives

impact cyberspace as essential infrastructure forwill include not only sector-specific issues

the development of socio-economic activities, has

weighing on the actors in the public and private

become an urgent issue. Furthermore, assectors but also common issues such as theirconnections grow between numerous things (IoT

scope, definitions, physical safety measures,devices) with different safety standards, including

demarcation points of responsibility (including

security levels or physical security, thosethe legal responsibilities of each actor including

connections have the potential to generate new

product liability of the manufacturers and thethreats. Given this situation, the government

safety management obligations of the operator,

must work with private sectors to build secure IoT

etc. for incidents concerning the response tosystems.

known vulnerabilities), and privacy issues.

visualize the issues and associated initiatives ofFurthermore, the government will work in[1] Improving Structural Framework for
IoT Systems and International
Standard

cooperation with private sectors to promote

To date, the government has worked onrealizing secure IoT systems in order to develop

cybersecurity measures for IoT systems together

value creation systems for IoT systems and deploy

with private sectors by carrying out various

it on a global scale while utilizing Japan’s

initiatives for realizing secure IoT systems,

strengths of safety and security in order toincluding the creation of guidelines. Moving

contribute to the development of the global

forward, it is necessary to place emphasis on

economy through spreading such secure IoTvalue creation by secure IoT systems, and work

systems.

efforts for international standardization of thebasic elements of cybersecurity required forstrategically with an integral and consistent[2] Preparing a Formation formanner.
40

To that end, according to the basic elements ofVulnerability Countermeasures

cybersecurity required to realize secure IoT

To handle the increasing seriousness of

systems presented so far by the government, thecyberattacks on IoT devices, it is important togovernment will cultivate a shared understanding

implement measures to ensure security andamong stakeholders of the basic principles,

trustworthiness of information andobjectives, methods, and time limits of measures,

communication networks, under the coordinationand clarify roles and functions of each sector or

and division of roles between industry, academia,

stakeholder. In addition, the government will

and the public and private sectors. For that

promote initiatives in which each stakeholder

reason, the government must work with private

cooperates while promoting autonomous

sectors to prepare a formation for cybersecurity

cybersecurity measures. Furthermore, to promotemeasures that cover the entire lifecycle of IoT

39

A system in which everything including home electrical appliances, automobiles, and smart meters are connected to the Internet

40

General Framework for Secure IoT Systems (October 2016, Cybersecurity Strategic Headquarters)

30

Cybersecurity Strategy

and other networks, making it possible to provide new services by utilizing big data, etc. that it generates.

devices from design and manufacturing throughoperation to disposal, and for measures regarding
vulnerable IoT devices on information andcommunication networks.
Cybersecurity measures for IoT devices that cover
the entire lifecycle should be implemented withfull consideration for how each device is used andthe relevant cybersecurity threats to it and thestate of overseas deliberations and technology
trends and developments. In addition, thesemeasures should be taken with the mutual
understanding and coordination of all
stakeholders such as IoT device providers,
telecommunications carriers, and users. As part ofthis, the government will work with private
sectors to list cybersecurity requirements for each
IoT device based on its characteristics andencourage the use of IoT devices that meet suchrequirements.
Furthermore, regarding measures for vulnerable
IoT devices on information and communication
networks, the government will steadily improvenecessary systems to survey and identify IoT
devices that use flawed password andexpeditiously warn users thereof by
telecommunication carriers. In addition, when
implementing measures, related ministries andgovernment agencies will work together andcoordinate with telecommunication carriers anddevice manufacturers.
In the future, the government intends tocontribute to establishing a safe environment byimproving global information andcommunication networks by taking these
Japanese measures as models and expanding
them overseas through international coordinationand standardization.

Cybersecurity Strategy

31

4.2

Building a Safe andSecure Society for the
People4.2.1

Measures for the Protection of
the People and SocietyWith increasing threats to cyberspace, many

For the realization of society in which the people

people have developed a feeling of anxiety about

can live safely and securely, it is important tocybercrime, leading to an increase in awarenessensure multi-layered cybersecurity, through theof cybersecurity throughout the society. Givencoordination of multi-stakeholders, includingthese conditions, it is essential for all stakeholders

governmental bodies, local governments, cyber-

to autonomously raise their security awareness

related enterprises, critical infrastructure

and work proactively while creating an

operators, educational and research institutions,environment where multi-layered cybersecurity isand every people themselves.

ensured in collaboration among stakeholders.

In particular, operations and services provided byoperators, industry associations, and local[1] Building a Safe and Secure Cyber
Environment for Users

governments (hereinafter referred to as critical

Because cybercrime and cyberattacks are

infrastructure operators etc.) form the foundation

becoming more sophisticated and complex, andthat supports smooth socio-economic activities

types of attacks are diversifying, they can noand people’s living. Given the understanding that

longer be handled using traditional passive

it is impossible to completely eliminate risks ofmeasures only, and more proactive measures

cybersecurity, the government will promotethan what were previously used must be

initiatives based on the “mission assurance”

implemented.

approach declared under the basic vision of

Given this situation, the government, cooperating

cybersecurity in order to reduce risks to anwith cyber-related enterprises, will promote theacceptable level and ensure that these operations

policy of “Proactive Cyber Defense41” that ensuresand services are provided safely and continuously.

the government to implement active preventive

Meanwhile, Japan is preparing for national andmeasures against threats in advance. Specifically,

international sporting events such as the Rugby

the government will work to promote such

World Cup 2019 and the Tokyo 2020 Games,

initiatives to prevent damages from cybercrime orwhich can be expected to provide incentives forcyberattacks such as promoting the sharing andcyberattacks to malicious actors. Thus, it isutilization of threat information to enable

necessary for each stakeholder to deal with eachpreemptive defense, using technologies to induce

situation by steadily carrying out their respective

attacks to collect information on attackers, androles and cooperating with each other to realize a

conducting measures against botnets.42

smooth implementation of the Tokyo 2020

The government will also promote theGames and other events while also looking

development of dependable information

further ahead to the future.

infrastructure, including the reinforcement ofgovernmental bodies, critical infrastructureinternational undersea cables and otherinfrastructure facilities, which will be the41

Initiative that defends proactively against cyberattacks.

42

Network that bundles together personal computers and other devices that have become completely manipulable by the attacker as
the result of virus infection (“bots”). Used maliciously for such acts as DDoS attacks and spamming. (source: Information-technology
Promotion Agency, Japan (IPA), Jouhou Sekyuritii Hakusyo 2017 (Information security white paper 2017))

32

Cybersecurity Strategy

foundation of overall services provided bytypes of cybercrime.

governmental bodies and critical infrastructure

To that end, the government continues tooperators, etc. The government will consider how

promote thorough investigative activities,

to verify the evaluation of trustworthiness andconsideration on new investigative techniques,

how to improve the practice of government

and public awareness campaigns to prevent

procurement and press forward with measures.

damages from cybercrime. For the purpose of

Furthermore, the government will work withdealing with crime where advanced information

providers of cryptocurrency services to promoteand communication technologies are used, themeasures so that the people may safely engage ingovernment will strengthen its digital forensics

the trading of cryptocurrencies. Also, with regard

capabilities, enhancing the technological prowess

to self-driving vehicles and drones, theto analyze the latest in digital devices orgovernment will promote measures to avoid themalicious software, and advancing comprehensive

occurrence of unauthorized operations due toanalysis for predicting threats to cyberspace andcyberattacks as they may cause risks to humanfor unraveling those threats technologically. The

life. With regard to self-driving vehicles ingovernment will also promote positive utilization

particular, the government will continue to takeof knowledge and experience of private

the lead in the ongoing debate in theenterprises, personnel exchange between public

international forums on the establishment ofand private sectors, and countermeasures againstinternational standards for cybersecurity.

cybercrime in which, in the light of information
sharing, information analysis, prevention of[2] Enhancing Measures against
Cybercrimes

damages due to cybercrime, and human resource

As cyberspace increasingly becomes part ofcollaborate each other.

people’s living, cybercrime has become a serious

In the event of cybercrime, it is necessary tosocial issue due to the occurrence of global scale

ensure traceability in cyberspace for investigation.

43

development, public and private sectors

damages from ransomware infections and cases

As cooperation with related business operators

in which unauthorized transmission of large

and international collaboration is essential formonetary amounts apparently was carried out

this, the government will implement any

against domestic cryptocurrency exchange

necessary initiatives for that purpose. Regarding

operators by malicious actors. In order to ensure

the appropriate preservation of communications

the safety and security of the people, thehistory data logs in particular, the government,

government will continue to work to grasp the44
on the basis of the relevant guidelines, will get

actual state of cybercrime and promote a

related business operators to take appropriate

crackdown on such crime while cooperating withmeasure.

related institutions or organizations in carryingout public awareness campaigns getting eachindividual person to promote autonomous
measures against cybercrime. Furthermore,
improvement of investigative and technologicalcapabilities is also essential for addressing new

Protection of Critical
4.2.2 Infrastructure through Publicand Private Sector Cooperation
Regarding the protection of critical infrastructure,43

A type of malware (short for malicious software) that encrypts data and then demands a ransom.

44

Explanation of the "Guidelines on the Protection of Personal Information in the Telecommunications Business.”
Cybersecurity Strategy

33

the government has implemented initiatives

the scope of security initiatives and strengthen

based on the set of five policy groups of the“protection as a plane,” as necessary. At the same

Cybersecurity Policy for Critical Infrastructure

time, it will further promote initiatives to share

45

Protection (4th Edition) (hereinafter referred to

information, and expand or enhance information

as the “Cybersecurity Policy”), based on the

sharing systems.

concept of “mission assurance” to provide critical
46

Furthermore, the active involvement of seniorinfrastructure services safely and continuously.

executives officials at critical infrastructure

However, the issue remains that there areoperators is essential to promote initiatives forvariations in the level of cybersecurity awarenessprotecting critical infrastructure. Accordingly, theand progress in initiatives between each critical

government will reach out to the seniorinfrastructure sector. In order to solve these

executives to raise their awareness of

issues, it is necessary to raise the overall level ofcybersecurity while promoting the following

cybersecurity. Accordingly, the government will

initiatives.

work with private sectors to provide proactive
support as each stakeholder works on its own( i ) Promotion of Risk Management

autonomous initiatives, including the

It is necessary to provide critical infrastructure

consideration of models for cybersecurity

services safely and continuously even during

measures regarding critical infrastructure

cyberattacks. For that reason, in addition tooperators with limited management resources for

implementing security measures in advance, it iswhich it is difficult to adequately invest inimportant for critical infrastructure operators tocybersecurity.

prepare business continuity plans (BCP) andcontingency plans based on the concept of[1] Primary Initiatives Based on the“Cybersecurity Policy”

mission assurance, in light of the results of risk

To date, the government has formulated andcomplex risks in mind. The government willrevised the “Cybersecurity Policy” for the

implement initiatives to ensure that these overall

protection of critical infrastructure, and it willrisk management activities function continuously

continue to implement initiatives based on theand effectively.

assessment with cross-organizational and“Cybersecurity Policy.” The “Cybersecurity Policy”
is scheduled for review following the Tokyo 2020
Games. However, it will be reviewed even prior to(ii) Improvement and Promotion of
Safety Principles

the scheduled date if necessary, if there are major

In order to promote appropriate handling bychanges in the direction of society.

critical infrastructure operators, the government

Critical infrastructure sectors are designated fromwill work on further promotion of guidelines forthe perspective of particularly requiring

the preparation of safety principles, while

protection in consideration of degrees of impact

continuously promoting initiatives to improve

they have on people’s living and socio-economic

those safety principles including theactivities. In view of social conditions, therecommendation of methods for data

government will expand the scope of criticalmanagement and reduction of risks due to humaninfrastructure sectors and operators to develop

factors based on surveys on the current state of45

Cybersecurity Strategic Headquarters Decision on April 18, 2017

46

These are the Maintenance and Promotion of the Safety Principles, Enhancement of Information Sharing System, Enhancement of
Incident Response Capability, Risk Management and Preparation of Incident Readiness, and Enhancement of the Basis for CIP.

34

Cybersecurity Strategy

data management and relevant international

and improve the contents thereof as necessary fortrends, taking into consideration such matters as

their continued development.

the content of the business, size of the
impact on international competitivity.

(v) Security Measures for Industrial
Control Systems (ICS)

Furthermore, from the standpoint of maintaining

There are critical infrastructure operators in such

safety, the government will appropriately improvesectors as electricity, gas, and oil that use

the institutional frameworks by means such asindustrial control systems (ICS) to provide

positioning cybersecurity measures as safety

services. In these cases, it is likely that normal

regulations within related laws and regulations,service provision becomes impossible when suchetc.

ICS are significantly affected by cyberattacks andorganizations, the duration of system use, and thethe like, causing a major impact on people’s(iii) NISC Cyber Incident Severity Scale
for CIS Outages

living. Accordingly, public and private sectors will

According to recent trends in cyberattacks, it isregarding ICS and carry out collection, analysis,

necessary to enable stakeholders, such as

and deployment of threat information as

governmental bodies and critical infrastructure

appropriate so that adequate security measures

operators, to quickly share their understanding

based on the characteristics of ICS will be

and determine whether a rapid response is

implemented for safe and continuous provision ofnecessary when a cyberattack is detected. To that

services.

unite to promote human resource development

end, the government will prepare the “NISC Cyberevaluate and publish the severity of incidents to[2] Strengthening and Enhancing
Security in Local Governments

encourage and enable diverse stakeholders to

The services provided by local governments are

respond rationally and appropriately while taking

closely related to people’s living, and any

into consideration the effect and impact of

obstacles on the provision of those services canthoroughly informing the public. The government

have a major impact on community activity.

will also review the Scale as appropriate to

While there are limits to technical solutions that

improve it.

can be taken for cybersecurity measures

Incident Severity Scale for CIS Outages” andindividually by organizations with limited（iv）Joint Training and Exercises

between Public and Private Sectors

resources, it is first and foremost necessary to
implement countermeasures against the leak of

It is important to conduct training and exercises

information, including Indivisual Number, due towith the assumption of the occurrence of service

service interruption or human error.

outages to increase the capabilities of criticalGiven this situation and while direct involvement47

infrastructure operators so that they can respondof the national government in local government

to such situations appropriately. The government

is limited compared to other organizations due toand related institutions will continue tothe current division of roles between national andimplement training and exercises among

local governments, local governments nationwide

stakeholders of various sizes across public andhave been undertaking the fundamental

private sector boundaries, and expand the scope

reinforcement of measures, and the national

47

Unification and auditing of technical specifications.
Cybersecurity Strategy

35

government will update its guideline on security

Responding to increasingly complex andpolicy as necessary in light of the necessity tosophisticated cyberattacks, there is a need to use

achieve a high level of security. The government

new technologies to overcome the existing state

will also work to achieve the necessary security

in which attackers have the advantage whilelevels for operational networks and promotestrengthening defense in depth that assume

initiatives to secure and develop cybersecurity

attacks will occur and countermeasures for risks

human resource, enhance systems as well as

to supply chains.

securing the necessary budget while being

The smooth execution of government services is

mindful of the need for smooth operations by

an extremely important responsibility for

local governments.

governmental bodies and Incorporated

Furthermore, with regards to identity federation

Administrative Agencies, etc. (hereinafter referredamong public and private sectors, theto as “the Agencies”), and it is important to makegovernment will work to improve thethe necessary IT investment and security-related

environment balancing between convenience andinvestment together as one when making

security.

investments for their systems. In light of thissituation, it is important to secure the funds

Strengthening and Improving
4.2.3 Security in Governmental Bodies
and Government-Related Entities

necessary to amplify security-related investments

To date, efforts have been made to raise the level

information security measures described above.

by such means as using the funds generated bymaking IT investment by the Agencies more
efficient for security, and to strengthen theof information security measures fordevelopment of information security measures[1] Advancing and Visualizing Security
Measures for Information Systems

based on unified standards, initiatives for auditing

The Agencies will utilize new defensive

based on those standards and the monitoring oftechnologies to carry out more effective

unauthorized communication, and theinitiatives, aiming not only to increase thegovernment is required to continue working on

response capability towards the growing threat ofthese initiatives. The framework for initiatives atcyberattacks, but also to prevent damages and, inIncorporated Administrative Agencies andthe case of the occurrence of damages, prevent its

Designated Corporations (hereinafter referred tospread and minimize the damage.

governmental bodies overall through theas “Incorporated Administrative Agencies, etc.”)
has been expanded in the same manner as forgovernmental bodies through the revision of the
Basic Act on Cybersecurity,48 and it will be an( i ) Increasing Defensive Capabilities
and Conditional Awareness for
Information Systems

important issue moving forward to promote

The Agencies will work to prevent damage

effective information security measures at

preemptively and prevent its spread thereof by

Incorporated Administrative Agencies, etc. indetecting malware behavior at the endpointconsideration of the characteristics of their(personal computer, etc.) where programs arediverse business forms.

run. By automation of IT asset management, the48

Enacted on April 15, 2016. Expanded the scope to cover the monitoring, auditing, and investigating the causes of unauthorizedcommunications by the government.

36

Cybersecurity Strategy

Agencies will monitor the state of information

private cloud that can utilize the benefits ofsystems in real time and enable the rapid

consolidating the building and operation ofhandling of software vulnerabilities. Datasystems and increasing the security level. In

protection initiatives will also be carried out for

promoting the use of the cloud, the government

all Agencies to prevent information leakage whenwill consider and go forward with measures toincidents occur. Furthermore, it is necessary to

promote the use of a reliable cloud in which an

examine measures for identifying attacks that areappropriate level of security such as safety

difficult to detect by analyzing threat, combining

evaluation is secured.

the phenomena that occur on various devices andWith regard to the Internet connection lines, theaccount management information. In order togovernment has also worked for the unification

implement those measures effectively, systems

and consolidation of the connection port underwith a view to automating the work required forthe common standard. The government will makeanalysis of information must be established.

the necessary considerations including theconsolidation of perimeter monitoring points(ii) Preventing Damages and the Spread
Thereof through the Advanced

while collaborating with government common
networks and platforms, since the further

Cross-Organizational Collaboration
among the Agencies

promotion of the appropriate consolidation ofWith consideration for the implementation statusbodies is extremely effective for operations andof malware monitoring on devices andsecurity measures.

Internet connection ports for governmental

automation of IT asset management at all stages,
response, the Agencies will aim for the[3] Preemptive Efforts Utilizing
Advanced Technology

development of cross-organizational initiatives bySome of the information system platforms thatsophistication of effective and efficient

have grown in use in recent years have acollaboration between the Agencies and theparticularly high level of resistance toincluding prevention, detection, recovery, and49

GSOC which includes the appropriate sharing

cyberattacks. The government will consider

with the GSOC of information to be gained on

utilizing the information technologies createdsuch measures.

under this new design philosophy for the
Agencies, work to accumulate knowledge of best

[2] Promoting Use of the Cloud for
Effective Security Measures

practices, and aim for a shift towards defender’sadvantage.

So that each Agency can select an appropriate
form of information system according to thecharacteristics of the information and that[4] Raising the Cybersecurity Level
through Auditing

security measures can be carried out efficiently

In light of the Basic Act on Cybersecurity, theand effectively for the overall government, thegovernment will provide the trends and issues

government will promote the use of cloud

identified through the cross-organizational

services including migration to a government

analysis of data from the auditing of the Agencies

common platform in the form of a government

as feedback for the entire Agencies to promote

49

Abbreviation of Government Security Operation Coordination Team. This team carries out cross-organizational monitoring andrapid response for the information security of governmental bodies.
Cybersecurity Strategy

37the further raising of the cybersecurity level. In

research environment.

addition, the government will utilize the IT asset
developed in accordance with initiatives in[1] Promoting Measures in Light of theDiversity of Universities etc.

monitoring the state of those systems efficiently,

The senior executives of universities etc. must

and will aim for efficient and effective

personally understand the importance of

implementation of auditing.

cybersecurity measures, position cybersecurity

management information of the Agencies that ismeasures as important managerial issues, and[5] Improving Organizational Response
Capability
50

carry out initiatives as an organization based on aplan for promoting cybersecurity measures, while

Primarily via the team that handles incidents,

also conducting follow-ups to further promote

the government will increase incident responsecybersecurity measures.

capability and information security knowledge of

In doing so, it is necessary to identify the IT assets

each Agency. In case of occurrences ofto protect, evaluate the cybersecurity risks, andcyberattacks to the Agencies, the government willconsider the managerial and technical measuresenhance the training, etc. for coping capability

to be prioritized when implementing inbuilding of the staff in order to strengthen theaccordance to those risks, with consideration formobile assistance formation (an emergency

the diversity of the universities etc. that conduct

51

assistance team for information security) which

education and research in various areas.

is comprised of government employees with

Furthermore, universities and research institutes

requisite knowledge and skills of eachalso need to consider initiatives to improve thegovernment agency.

capability to respond quickly and appropriately toincidents, and a system to implement the

Ensuring a Safe and Secure
4.2.4 Educational and Research
Environment at Universities etc.

measures organizationally and steadily.

Universities and Inter-University Research

cybersecurity; implementing practice for each

Institutes etc. (hereinafter referred to aslevel regarding risk management and incident“universities etc.”) are staffed by various

response, and practical training and exercises, andmembers with a diverse collection of IT assets

support for the initial response to the event ofand systems in use. Given the nature of theseincidents.

The government will promote the autonomousand organizational initiatives of the universities
etc. by creating and disseminating guidelines on

universities etc., along with the implementationof autonomous cybersecurity measures by theuniversities etc. by themselves, it is important for
the government to proactively support the[2] Promoting Cooperative andCollaborative Initiatives by
Universities etc.

building of response system and sharing of

Universities etc. use common information

information etc. to deal with cyberattacks throughplatforms and face similar cybersecurity issues.

collaboration among the universities etc. in order

Strengthening of the cybersecurity measures in

to ensure a safe and secure educational andlight of these actual conditions at the universities

50

CSIRT (Computer Security Incident Response Team)51

CYMAT (Cyber Incident Mobile Assistant Team)

38

Cybersecurity Strategy

etc. is considered important, and there is a need

the past and, by their nature, some attacks will

for further promotion of initiatives throughassumingly be targeting multiple service sectors.

mutual cooperation of all the parties involved.

For that reason, the government will ensure

For this reason, organizations that operate sciencecybersecurity for the Tokyo 2020 Games andinformation networks will collaborate withpromote further measures looking beyond thenational universities etc. to develop a system toevent.

monitor, detect, and analyze cyberattacks andThese various measures will be expanded inprovide information on those attacks, while also

scope and continued after the Tokyo 2020 Games,

carrying out joint research and training forand the legacy of the systems developed, andtechnical staff to maintain and strengthen theexperience and knowledge in their operation willfunctions of monitoring capabilities and develop

be utilized to strengthen cybersecurity in Japan

strategic management level, and training forcontinuously into the future.

technical staff.
at those universities etc., the government will also

[1] Preparedness for the Tokyo 2020
Games

support initiatives that the incident handling

Based on the basic strategy52 decided by theteam for multiple universities and research

Security Board Meeting of the Headquarters for

institutes shares information, common issues andthe Tokyo 2020 Olympic/Paralympic Games, theknowledge for incident response related togovernment will continue the collection of

cyberattacks.

information concerning the safety of the Games

In order to strengthen the incident response teamand other measures. It will also carry out the

4.2.5

Initiatives for the Tokyo 2020
Games and Beyond

assessment of cybersecurity risk sources taking
into consideration the coordination with physicalsecurity, conduct the cybersecurity risk

Countless athletes, foreign dignitaries, andassessment of critical service providers that havesupporters will gather from all over the world forthe potential to affect the Tokyo 2020 Games

the Olympic/Paralympic Games, giving theoperations including the consideration of risk

hosting of the event the highest possible level ofscenarios based on the results of the assessment

attention and potentially making it a target forof cybersecurity risk sources, and promote

cyberattacks.

measures for various risks including the cross-

Reflecting on the past Olympic/Paralympic

sectoral risks identified by the risk assessment. In

Games, it has been reported that there was a

addition to the sharing of information on

massive number of cyberattacks during the

cybersecurity threats among Olympic related

London 2012 Games, though they did not affectorganizations, such as the relevant ministries andthe operation of the event. Similarly, according togovernmental agencies, the Tokyo Organisingsome reports there was a significant number ofCommittee of the Olympic and Paralympic

cyberattacks causing damages to the Rio deGames, the Tokyo Metropolitan Government,

Janeiro 2016 Games and the PyeongChang 2018

local governments providing venues, and critical

Games. The Tokyo 2020 Games is also expected

service providers, the government will promote

to be subject to even more cyberattacks than in

the development of the Cyber Security Incident

52

The Basic Strategy on Security for the Tokyo 2020 Olympic/Pralympic Games (the Security Board Meeting of the Liaison Council of
Ministries and Agencies Related to the Tokyo 2020 Olympic and Paralympic Games, March 21, 2017)
Cybersecurity Strategy

39Response Coordination Center (Government

awareness is steadily spreading in both the public

Olympic/Paralympic CSIRT), the organizationand private sectors that emphasizes collaboration

through which the government takes a role towith other organizations, and not only

coordinate the Olympic related organizations so

administrative organs and critical infrastructurethat they can respond to cybersecurity incidents

operators, but also a wide range of othertogether when an incident occurs, and work to

stakeholders are beginning to work on

ensure the preparedness for close communication

information sharing.

and coordination.

As the number of sectors closely related to[2] Passing on Results that Lead to the
Futurecyberspace further grows due to the increasing

The government will continue to promote theexpected that the scope of sectors andvarious measures in preparation for the Tokyo

stakeholders that need to share information

2020 Games, and the systems developed, and thecontributing cybersecurity will continue tooperational experience and knowledge of those

expand.

systems will be utilized as a legacy to strengthen

Accordingly, from the standpoint ofJapan’s continuous cybersecurity after the Tokyo“participation, coordination and collaboration”

2020 Games. Furthermore, the Cyber Security

presented as part of the Basic Vision of

Incident Response Coordination Center will be

Cybersecurity, the government must support

utilized as an organization (national CSIRT) to

existing initiatives for information sharing

serve as a coordinator and coordinating desk forsystems, such as ISAC,53 through the close

all of Japan to work together to deal withcoordination between the stakeholders, whilecyberattacks. The methods for risk managementtaking on new roles.

unification of cyberspace and real space, it isdescribed in the Basic Vision of Cybersecurity will
be prepared and disseminated for wide
application to business operators throughout thecountry.

[1] Promoting Information Sharing and
Collaboration between MultiStakeholders
With the increase in the number of stakeholders

Building an Information Sharing/
4.2.6 Collaboration Framework that Extends
beyond Traditional Frameworks

engaged in information sharing, the importance

Essentially, the establishment of cybersecurity

because the inappropriate handling of the sharedshould be an initiative that each organization

information has the potential to cause a decline

carries out autonomously according to the value

in the social appraisal and trust, it remains anof its data assets and the state of information andissue that the stakeholders are reluctant tocommunication technology utilization.

proactively share the data they possess.

Meanwhile, due to the changes in attack modes,

Given this situation, the government will work tothere has been a limit to the ability to put in placebuild a new system that will enable multi-

effective countermeasures against cyberattacks

stakeholders in the public and private sectors,

within a single organization. For that reason, an

including specialized agencies with adequate

53of the role of collecting and analyzing theinformation and coordinating the stakeholders ina timely manner also increases. In the meantime,

Abbreviation for Information Sharing and Analysis Center. This organization collects information on cybersecurity for analysis. The
analyzed data is shared with ISAC members for use in their respective security measures. (Source: Cybersecurity 2017 (August 25,2017))

40

Cybersecurity Strategy

knowledge and experience in information

also work to achieve appropriate and swift

sharing, to share information contributing

analysis and sharing of information truly needed

cybersecurity without anxiety. When doing so, it

by each stakeholder through the promotion ofwill be important to respect the autonomy ofautomatic processing of received information andeach stakeholder in accordance with the principle

other means.

of autonomy presented in the Basic Principles.

Through this initiative, the understanding that

Information sharing and coordination thatthe mutual sharing of information is essential totranscends public-private, industrial, national,

increase cybersecurity will be cultivatedand other boundaries between public and private

throughout society. Furthermore, having the sightsectors, industries, and the domestic andset on the strategic collaboration with theinternational will be promoted by implementing

international community is also essential, while

this initiative.

developing Japan’s information sharing system.

The government will also consider collaboration

The government will work closely with each

and unification between the multiple existing

stakeholder and work proactively towards

information sharing systems in the public andimproving the necessary environment to enableprivate sectors with consideration for theeach stakeholder to build relationships forcharacteristics and roles of each of them so thatcoexistence and mutual development thatthe relevant parties shall not incur additionaltranscend the conventional sectoral boundaries

burden by new system.

associated with industries and the public andprivate sectors. This will enable the sharing of[2] Towards a New Stage in Information
Sharing and Collaboration

information and collaboration regarding
cybersecurity to move ahead to a new stage.

For the development of a new information
sharing system, the government will consider astructure in which multi-stakeholders can build
relationships of trust, and in which the more they
actively collaborate and cooperate in providing

Strengthening the Incident
4.2.7 Readiness Against Massive
Cyberattacks

information, the more they receive benefit fromCyberattacks have occurred overseas andthe system.

significantly impacted people’s living, causing

The more the level of collaboration andmassive power outages or partial losses ofcooperation with other parties increases, thefunctioning of financial institutions. As

greater the benefits of participating in theunification of cyberspace and real space

information sharing system become. Accordingly,

continues, it is well within the realm of possibility

the government must take the lead in sharing thefor cyberattacks to cause incidents in real space ininformation in its possession appropriately. The

our country in the future. Furthermore, massive

government will also develop an environment incyberattacks can be expected to cause

which stakeholders that proactively share theirsimultaneous damages to services that are

own information regarding such matters asnormally relatively unrelated, and the country

cybersecurity incidents is positively regarded. In

must work as one to address risk management forparticular, it is essential that information

threats in cyberspace to protect society and theregarding cybersecurity that causes recalls to

people from those threats.

protect the life and physical well-being of people

The government will carry out response training

is shared swiftly and surely. The government will

and exercises across both cyberspace and real
Cybersecurity Strategy

41

space while strengthening the preparations to
respond to cyberattacks through training andexercises in order to work on risk management
for both cyberspace and real space. The
government will also promote training of
personnel capable of analyzing cyberattacks, thesharing of information through a framework for
public and private sector coordination, and theadvancement of Internet monitoring in an effort
to improve data collection and analysis
capabilities and emergency response capabilities
in cyberspace.

42

Cybersecurity Strategy

Contribution to the Peaceand Stability of the
4.3 International Community andJapan’s National Security
A free, fair, and secure cyberspace contributes tothe peace and stability of the international
community and to Japan’s national security.

cyberspace, Japan will communicate its positionin the international fora, ensure its national
security by utilizing existing frameworks, andpromote international collaboration.

4.3.1

Commitment to a Free, Fair,
and Secure Cyberspace

A cyberspace, which is open to all actors andIn order to realize a free, fair, and secure

where the autonomous and free flow ofcyberspace at the global level, Japan will

information is secured, fosters innovation andcommunicate its idea in the international fora

constitutes the foundation of democracy.

and take an active role in promoting the rule ofCyberspace has developed through technologicallaw in cyberspace.

innovations, inventions, and initiatives of multipublic and private sectors. Excessive control by[1] Communicating the Ideas of a Free,
Fair, and Secure Cyberspacestates will impede the autonomous andIn order to maintain the ecosystem ofsustainable development of cyberspace. For theautonomously and sustainably developing

sound development of cyberspace, multi-

cyberspace, Japan will aim to ensure the safety instakeholders need to cooperate to ensure the freecyberspace through the coordination andflow of information, and maintain the openness

collaboration among multi-stakeholders on

and autonomy of cyberspace.

efforts to ensure cybersecurity, rather thanAs the use of cyberspace accelerates throughout

through control and regulation such associety, leading to the advancement of thecontrolling the flow of information by states.

unification of cyberspace and real space, theJapan will communicate such basic approach toissues in real space, such as human rights, privacy,

cybersecurity in the international fora. In

crime and terrorism, and national security, areaddition, Japan will work with our ally and like-brought into the realm of cyberspace and posing

minded countries, as well as private entities tochallenges. Accordingly, it is necessary to carrythwart any efforts that aim to inhibit theout initiatives with regard to these challenges todevelopment of cyberspace such as through theensure the safety and security of cyberspace.

change of international rules.

Since cyberattacks can easily cross national

In doing so, it is necessary to separate discussions

borders and there are incidents that are suspectedon how to manage Internet resources fromof being state-sponsored, it is necessary to

discussions of the issues that arise through thepromote the rule of law, increase defense,

use of cyberspace such as human rights, privacy,

deterrence, and situational awareness capabilities

crime and terrorism, and national security. Withagainst cyberattacks and promote international

regard to the issues that arise through the use ofcooperation and collaboration in order to ensure

cyberspace, discussions need to be conducted

the security and stability of cyberspace. However,under the premise of the existing frameworks.

stakeholders in industry, academia, and thewhen doing so, it is necessary to pay attention inorder to avoid impeding the autonomous andsustainable development of cyberspace.
In order to safeguard a free, fair, and secure[2] Promoting the Rule of Law inCyberspace

The promotion of the rule of law is important for
Cybersecurity Strategy

43

the peace and stability of the international

critical infrastructure operators, companies andcommunity and Japan’s national security.

academic and research institutions possessing

Existing international law, including the Charter

advanced technologies. There are cases thatof the United Nations, applies to cyberspace also.

might threaten to undermine the foundations ofJapan takes this position and will proactively

democracy. Furthermore, some of these attacks

contribute to discussions on the individual andare suspected of being state-sponsored.

specific applications of existing international law

Given this situation, in order to protect the Japan’s

and the development and universalization ofnational security interests from cyberattacks, it isnorms. Also, Japan will promote theimportant to secure Japan’s resilience against

universalization of norms of behavior ofcyberattacks and increase Japan’s ability to defend

responsible states that have been apparent tothe state (defense capabilities), deter

54

date by steady implementation and practice ofcyberattacks (deterrence capabilities), and besuch norms. Japan will deter any acts against suchaware of the situation in cyberspace (situational

norms through the universalization of such norms

awareness capabilities).

in the international community and the

All relevant public and private stakeholders led byaccumulation of relevant state practices thereof.

the National center of Incident readiness andWith regard to measures against cybercrime, theStrategy for Cybersecurity with regard to defense,

National Police Agency and other relevant

the ministries and agencies responsible forministries and agencies will collaborate to further

response measures with regard to deterrence, andpromote international partnership throughinformation gathering and investigativeinternational investigative cooperation andorganizations with regard to situational

information sharing with internationalawareness will closely cooperate on a daily basisorganizations, law enforcement agencies andand proceed with the initiatives related tosecurity information agencies in foreign countries

national security, under the overall coordination

leveraging frameworks such as the Convention on

by the National Security Secretariat. When

Cybercrime, mutual legal assistance treaties, andnecessary, deliberation and decision will be madethe ICPO.

55

at the National Security Council.

Through these initiatives, Japan will promote thethe international community and Japan’s national[1] Ensuring National Resilience( i ) Mission Assurance

security.

It is the mission of governmental bodies torule of law and realize the peace and stability ofprotect and support people’s lives and socio-

Strengthening Capabilities for4.3.2 Defense, Deterrence, andSituational Awarenesseconomic activities. Any failure in playing their

The security environment in cyberspace isprovided by critical infrastructure operators andgrowing increasingly severer. Cyberattacks haveother business operators which maintain social

been taking place against governmental bodies,system. These operators also have an important

54

role is a significant concern for national security.
The execution of the missions of thesegovernmental bodies relies on the services

These include the 2015 report of the fourth session of the United Nations Group of Governmental Experts on Developments in the
Field of Information and Telecommunications in the Context of International Security (UN GGE), the 2015 G20 Antalya Summit
Leaders’ Communiqué, and the 2017 G7 Declaration on Responsible States Behavior in Cyberspace.

55

ICPO is the Acronym for International Criminal Police Organization.

44

Cybersecurity Strategy

mission to provide these services indispensable

between the public and private sectors.

for the people and the society.

Furthermore, the government will promote

Japan will promote the establishment of

measures at national research and development

cybersecurity for governmental bodies and criticalorganizations and universities and research

infrastructure operators in order to assure theinstitutes possessing advanced technology fromexecution of the missions of those governmental

the viewpoint of protecting information on

bodies related to national security and to provide

advanced technologies.

services essential for the people and the society.
As the defense authorities, in particular, theMinistry of Defense and the Self-Defense Forces,
will continue to strengthen the defense of the(iii) Measures Against the Malicious Use
of Cyberspace by Terrorist
Organizations

networks and infrastructure on which their

Cyberspace offers a place where individuals andoperations depend, while further enhancing theorganizations can exchange information andcapabilities of cyber defense units against

express their thoughts freely. It now serves as thecyberattacks, and deepen collaboration withfoundations of democracy. On the other hand, it

stakeholders involved in the mission assurance ofis necessary to prevent the malicious use of

the Self-Defense Forces.

cyberspace by terrorist organizations, such as
spreading and demonstrating violent externism,(ii) Protection of Japan’s Advanced
Technologies and Defense Related
Technologies

recruiting into the organizations, and gathering

Advanced technologies are important national

analysis of information on the activities ofassets not only for assuring economic advantage,

terrorist organizations in cyberspace and take any

but for national security as well. Japan willother necessary measures in collaboration withstrengthen cybersecurity measures, including thethe international community, while also

reduction of human caused risks faced by theguaranteeing the basic human rights including

business operators and relevant ministries andthe freedom of expression.

funds for organizations. For that reason, thegovernment will strengthen the collection andgovernmental agencies that handle thesecurity, such as technologies related to outer[2] Enhancing Deterrence Capabilities(i) Measures for Effective Deterrence

space, nuclear energy, security, and the defense

International law, including the Charter of theequipment. Particularly, the leak or illegal

United Nations, applies to cyberspace. As G7

disclosure of the technical information held byleaders affirmed at the Ise-Shima Summit, under

the defense industry would have a major impact

some circumstances, cyber activities couldon Japan’s national security. For that reason,

amount to the use of force or an armed attack

Japan will work to adopt a system to ensure thewithin the meaning of international law.56 Also, as

safe sharing of information, establish new

G7 foreign ministers affirmed at Lucca, among

information security standards for contractors,

other lawful responses, a State that is the victim

and revise contractual provisions. Deliberationsof an internationally wrongful act may, in certain

will be carried out with the assumption that thesecircumstances, resort to proportionate

measures will be applied to the entire supply

countermeasures against the State responsible forchain for the defense industry, including

the wrongful act.57

subcontractors, through the collaboration

Based on the above-mentioned recognition, in

technologies important to Japan’s national

Cybersecurity Strategy

45

order to deter malicious cyber activities andbuild up international communication channels

protect the people’s safety, security, and rights, induring normal times in preparation for theclose coordination with our ally and like-mindedoccurrence of incidents that extend beyond

countries, Japan will utilize political, economic,

national borders. It is also necessary to increasetechnological, legal, diplomatic, and all othertransparency and build confidence between states

viable and effective means and capabilities,

through the proactive information exchange anddepending on the threat, and take resolutepolicy dialogues in bilateral and multilateral

responses against cyber threats that undermine

consultations. The government will also

our national security, including those possibly

cooperate with other states to consider astate-sponsored.

mechanism for coordinating issues regarding

The government will strengthen the coordination

cyberspace.

system among relevant governmental bodies with
the Cabinet Secretariat as its core in order tomake timely and appropriate responses, promote[3] Strengthening Cyber Situational
Awarenessin a comprehensive manner, and the government(i) Increasing the Capabilities of Relevant
Governmental Bodies

will also strengthen capacity at the relevant

In order to deter increasingly serious cyberattack,authorities including law enforcement authorities

in addition to enhancing response capabilities,

and the Self-Defense Forces. In this regard, theadequate capabilities to detect, investigate, andacquisition of capabilities to prevent malicious

analyze cyberattacks are necessary to make thecyber actors from using cyberspace may be

attackers accountable. To this end, theconsidered.

government will quantitatively and qualitatively

as a whole inter-agency and cross-sectoral efforts

improve the information collection and analysis(ii) Confidence Building Measurescapabilities of the relevant governmental bodies.

The government will work to build confidence

Accordingly, the government will proceed withamong states in order to prevent the occurrence

wide ranging considerations of any effectiveof unforeseen circumstances and deterioration ofmeans including the development andthe situation caused by cyberattacks. Due to thesecurement of a cybersecurity human resource

the anonymity and secrecy of cyberattacks, therewith high-level analytical capabilities, andare risks that cyberattacks unintentionallydevelopment and utilization of technologies forincrease tentions among states and worsen thedetecting, investigating, and analyzing

situation. In order to prevent such accidental andcyberattacks. The government will also carry out

unnecessary confrontations, it is important toinitiatives related to counter-cyber intelligence.58

56

G7 Principles and Actions on Cyber (May 2016) “We affirm that under some circumstances, cyber activities could amount to the useof force or an armed attack within the meaning of the United Nations Charter and customary international law. We also recognizethat states may exercise their inherent right of individual or collective self-defense as recognized in Article 51 of the United Nations
Charter and in accordance with international law, including international humanitarian law, in response to an armed attack throughcyberspace.”

57

G7 Declaration on Responsible States Behavior in Cyberspace (April 2017) “We note that, in the interest of conflict prevention andpeaceful settlement of disputes, international law also provides a framework for States’ responses to wrongful acts that do not
amount to an armed attack - these may include malicious cyber activities. Among other lawful responses, a State that is the victim
of an internationally wrongful act may, in certain circumstances, resort to proportionate countermeasures, including measuresconducted via ICTs, against the State responsible for the wrongful act in order to cause the responsible State to comply with its
international obligations”

58Intelligence defense activity against hostile intelligence activity by foreign countries using information and communication
technology

46

Cybersecurity Strategy

(ii) Threat Information Sharing
Information sharing among relevant ministries[1] Sharing Expertise and Coordination
Policyand agencies within the government and with our

The government will work through bilateralally and like-minded countries is essential for

dialogues and international conferences on

accurately responding to and deterring diverse

cybersecurity to exchange information on

threat of cyberattacks, including those suspectedcybersecurity policies, strategies and system toof state-sponsored and by non-governmental

respond, and utilize that knowledge in planning

organizations. Accordingly, the government will

Japan’s cybersecurity policy. We will also

promote the sharing of threat information withstrengthen its cooperation and collaboration

our ally and like-minded countries. The

regarding cybersecurity policy with strategic

government will also strengthen the threat

partners that share basic principles on

information sharing and collaboration framework

cybersecurity with us.

within the government led by the Cabinet
Secretariat.

[2] International Collaboration for
Incident Response

International Cooperation and
4.3.3
Collaboration

The government will share information on

Because the effect of incidents in cyberspace cancoordinated response when incidents occur. The

easily extend beyond national borders, cybergovernment will also work to improveincidents in overseas can always affect Japan.

coordinated response capabilities through joint

Japan will cooperate and collaborate with thetraining and participation in international cybergovernments and private sector worldwide to

drills and joint training. Furthermore, theensure the security of cyberspace and work

government will respond appropriately in the

towards both the peace and stability of thecase of incidents through appropriate

international community and the national

international collaboration.

cyberattacks and threats and strengthen
cooperation between CERTs59 to enable thesecurity of Japan.
To this end, the government will proactively[3] Cooperating for Capacity Building

contribute to various international discussions

Today, as interdependence across borders has

and work for the sharing of information anddeepened, it is not possible for Japan to its securedevelopment of common understanding

peace and stability only by itself. Global

regarding cyber related issues. The government

coordination to reduce cybersecurity

will also share expertise with foreign countries,

vulnerabilities and to aim for their elimination

promote specific cooperation and collaboration,

thereof is essential in contributing to ensuring

and take actual action. Furthermore, we will

Japan’s national security.

secure and train personnel in the public andFrom this standpoint, assisting capacity building

private sectors who are capable of expressing ourin other state ensures the stability of the lives of

position to the international fora.

Japanese residents and the activities of Japanesecompanies in other countries that depend on
critical infrastructure in those states as well as thesound development of the use of cyberspace

59

The Computer Emergency Response Team (CERT) is an organization that responds to computer security incidents.
Cybersecurity Strategy

47

there. At the same time, it is also directly
connected to ensuring the security of all
cyberspace and contributes to the improvementof the security environment for the entire world
including Japan.
According to the Basic Strategy on Cybersecurity
Capacity Building for Developing Countries60
published in 2016, the government willproactively promote capacity building indeveloping countries.

60

Basic Strategy on Cybersecurity Capacity Building for Developing Countries (October 2016, Cybersecurity Strategic Headquarters)48

Cybersecurity Strategy

4.4

Cross-Cutting Approaches
to Cybersecurity

information on the demand for personnel andmeasures regarding human resource
development in order to strengthen the

In order to achieve the three policy goals –development and assurance of the cybersecurity“enabling socio-economic vitality and sustainablehuman resource. In doing so, it is important todevelopment,” “building a safe and secure society

ensure the diversity of personnel from thefor the people,” and “contribution to the peace

standpoint of promoting innovation.

and stability of the international community andon human resource development and research[1] Training and Adoption at theStrategic Management Leveland development as a foundation for the policy

In order to push forward cybersecurity measures

goals from both a cross-cutting and mid- andas a part of company management, it islong-term perspective. Simultaneously, it is also

inappropriate to leave the task up to experts andcrucial to promote a cooperative approach inoperational level staff because cybersecurity is

which everyone plays a role in working on

not simply a technical issue.

cybersecurity as an active agent in cyberspace.

Under the management strategies and businessJapan’s national security,”- it is important to work

strategies that the senior executive management

Development and Assurance
4.4.1 of Cybersecurity Human
Resource

presents, the personnel capable of meeting thisvalue is being created towards the realization ofoperations and services as part of the risks

Society 5.0, and it is necessary that eachthat an organization must manage; andstakeholder take the initiative and play theirchallenge must:( i ) understand the cybersecurity-related risks
that must be assumed in conducting(ii) utilize and command operational- level staff

respective roles rather than relying on the efforts

experts to execute countermeasures andof few experts to ensure cybersecurity.

responses to incidents in the role of providing

In preparation for the future relevant to thisthe core support for risk management

coming paradigm shift, there is a need to clarify

regarding business continuity and value

the level of knowledge and skill required ofcreation

personnel involved in establishing cybersecurity

Accordingly, the government will define thefrom the standpoint of supporting each

personnel taking on these roles as the “strategicorganization to carry out its mission and the safe

management level” and work for the adoption ofuse of cyberspace. Following this, it is necessary

this concept through collaboration with industry,

to form a virtuous circle in which the supply andincluding the promotion of understanding among

demand for personnel is appropriated by:

the senior executives.

adequately treating personnel with good

There are also cases where, due to differences inknowledge and practical abilities, certified byculture or custom within industries or businessqualifications and evaluation standards obtained

categories, it may be difficult to integrate andthrough education and; further enabling them to

implement cybersecurity measures into existinghone their skills through repeated practicalmanagement systems for realizing operations andexperience.

services. For that reason, the government will,

To that end, the government will work withwhile taking into account consider that there areindustry, academia, and the public sector to sharemany ways of business and management, and the
Cybersecurity Strategy

49

government will promote the implementation ofsubjects as response methods, including attack

relearning programs, by means of themethods and defense methods against

development of practical learning materials forcyberattacks, and the systematization of methods

the strategic management level and thefor collecting, analyzing, and evaluating

identification and training of instructors.

information.

[2] Training for the Operational andExpert Level[3] Preparing a Foundation for
Development of Cybersecurity

As for the operational and expert level who
implement the measures regarding system

Human
Resourceplanning, building, and operation, based on the

In preparation for the evolution of information

instruction expressed by the strategic

and communication technologies in the mid- andmanagement level, numerous educational

long-term, it is necessary to promote theprograms, certification and testing programs, andunderstanding of the basic principles that form

training have been carried out through public andthe foundation for cybersecurity as an applied

private sector cooperation.

sector and improve the initiatives for developing

It is necessary to continue to strengthen suchthe ability to think logically and conceptually. To

initiatives to raise knowledge- and skill-levels.

that end, regarding the fundamentals of

Operational and expert level staff should also

cybersecurity and information anddeepen their understanding of the information

communication technologies, the industry,

and communication technologies, control system

academia, and the public sector will collaborate

technologies and cyberattacks that evolve on ato consider the knowledge and technology

daily basis. In addition, it is important insystems and a model curriculum based on those

responding to these attacks that they understandsystems.

the policies of senior executive management and

The government will also steadily work on

function as part of a team, communicating with

fostering the ability to utilize information within

other expert level personnel. To do so, it isthe educational curriculum at the elementary andnecessary to use development programs forsecondary educational level in order tooperational and expert levels to develop skills forstrengthen the education among youth

understanding the conceptual and abstract ideas

concerning cybersecurity and information andpresented by the strategic management level andcommunication technology skills, including such

converting them into concrete measures whilemeasures as making computer science a required

engaging in smooth communication with asubject from elementary school, and cultivating

variety of stakeholders.

logical modes of thinking, such as

The government will also continue to identify,

programmatical thinking, and an understanding

train, and assure personnel with exceptionalof the systems and principles of information andabilities who are capable of competing on thecommunication technologies according to theglobal stage. For example, the government willlevels of children’s development. The government

continue to promote the expansion ofwill place an emphasis on expanding andopportunities for personnel to apply themselvesenrichment of training for teachers, while also

diligently to acquire world-class competitive

working to ensure that course items regarding theability and the development of their capability tofostering of the ability to utilize information are

examine measures through research on suchproperly included in the teacher training courses.

50

Cybersecurity Strategy

When doing so, it is important to promote thecompensation, while working to further improveflexible utilization of personnel from industry as

those initiatives through annual reviews of plans.

necessary. In addition, promoting information
moral education is another important issue, due[5] Promoting International Partnershipto the rise in cybercrime perpetrated by the youth

Considering that the response to cybersecurity

in recent years.

issues are needed on a global scale, Japan should

Furthermore, it is also necessary to prepare an

enable the possibility for global application asenvironment in which there are abundantmuch as possible as a part of the development ofopportunities for the youth, who are expected tocybersecurity human resource, instead ofacquire advanced cybersecurity skills in thefulfilling that need within Japan alone. To thisfuture, to take an interest and learn freely using

end, the government will collaborate with leading

cybersecurity tools and devices in places outside

nations to build a system for promoting

the school curriculum such as the community,

collaboration in various ways with organizations

companies, and organizations through theengaged in human resource development

flexible use of industry personnel. At the same, it

overseas, such as the implementation of joint

is considered that the development of thistraining programs and certification of credit

environment for self realization will be effective

transfer, by certifying the human resource

in preventing cybercrime perpetrated by youth

development programs of universities and public

out of curiosity when combined with ethics

institutions as meeting certain requirements

education. The government will also continue toaccording to international standards.

promote the development of human resources for

In addition, with the aim to contribute to theinformation technology in higher education suchdevelopment of cybersecurity human resource

as universities and National institute ofoverseas as well, the government will utilize thetechnology through industry-academia-publicknowledge and experience gained through thepartnerships.

development of cybersecurity human resource inJapan to contribute to the capacity building[4] Strengthening the Assurance andDevelopment of Cybersecurity
Human Resource at Agencies

The government will continue to work to steadily
ensure and develop cybersecurity human resource

among cybersecurity human resource overseas.

4.4.2

Advancement of Research andDevelopment

at the Agencies under the command and control

As the unification of cyberspace and real spacefunction of the full-time Assistant Vice Minister

continues, practical research and development

for Cybersecurity and Information Technology(R&D) on cybersecurity is needed, given theManagement who carries out security measures

advancement of innovation in cyberspace and thebased on the unified policy for governmental

threat of cyberattacks against those innovations.

bodies. The government will also steadily carry

Along with this, responses with a view toout initiatives based on the human resource

discontinuous evolution of technology and society

assurance and development plans of Agencies,

over the mid- and long-term are also necessary.

through the increase of staff, training appropriate
to each level for increasing knowledge and ability,[1] Promoting Practical R&D

and practice involving high level security

Innovative new products and services aretechnicians, and ensuring appropriate

expected to be created through the combination
Cybersecurity Strategy

51

of various information and communication

cyberattacks from the cybersecurity operations

technologies such as IoT and AI. The provision of

workplace is shared with researchers as quickly as

products and services with a high level of security

possible for application in R&D, while the results

quality is essential when aiming for the growth ofof the R&D is also shared for application in theindustry and the enhanced international

cybersecurity operations workplace as quickly ascompetitiveness for Japan.

possible. To achieve this, the government will

Meanwhile the use of these technologies has thepromote the sharing of information in real timepotential to generate new vulnerabilities that did

between security operations companies andnot previously exist. To that end, the government

governmental research and development

will work with a focus on technology that ensuresinstitutions.

cybersecurity through the use of such advanced

It is also important to ensure means to verify, as

technologies as AI and blockchain, security

necessary, that malicious programs and circuits

technology that can be built in to the systems

are not built into the devices and software used incomprising products and services, and practical

the systems of governmental bodies and critical

R&D regarding the methods for such built-in

infrastructure operators. Accordingly, thesecurity technology. In particular, thegovernment will take a central role to develop agovernment will promote R&D on certification

system for carrying out the necessary technicaland generating trust, and ensuring traceability ininspections while also working on R&D necessary

the value creation processes of supply chains, andfor that purpose. R&D will also be promoted on

on detection of and defense against attacks infundamental technologies that are essential tothese areas. In addition, it will also engage in thethe state from the standpoint of national security,

development of technology to effectively detectsuch as encryption technology that takes into

malicious hardware and software built into

account the development of computing

devices and in R&D to ensure the authenticity,

technologies (e.g. quantum computing and AI).

availability, and confidentiality of data andFurthermore, in addition to these technology

information when behavior unintended by the

related R&D, research and studies on policy issues

user may be caused on the platform.

in cybersecurity measures will also be promoted,

The government will also promote R&D thatsuch as clarifying the interpretation ofincreases situational awareness capabilities incybersecurity related laws and regulations.

cyberspace including the ability to detect andRegarding these R&D initiatives for cybersecurity,

analyze cyberattacks, and contributes to ensuring

the government will promote the dissemination

national security in cyberspace, such as theand social adoption of the results. In addition, it

improvement of defensive and response

will work to strengthen R&D-related international

capabilities and ensuring of resilience.

partnerships in the public and private sectors with

Specifically, the government will promote R&D

like-minded countries that share basic values with

with the aims to understanding attack activity by

Japan through joint research and the creation ofluring attackers into networks that imitate

international standards based on the researchorganization such as governmental bodies andresults while proactively participating in overseas

companies, and to reduce the burden of wide area

events to disseminate information

network scanning for the survey on vulnerable

internationally.

IoT devices on the network. In implementing thisR&D, it is important to form a virtuous cycle inwhich the knowledge and experience of52

Cybersecurity Strategy

[2] Responses with a View to the Midand Long-Term Evolution ofTechnology
and Society

Cooperation by Everyone who
4.4.3 is the Main Player in
Cybersecurity

As the unification of cyberspace and real spaceWith the spread of devices such as smartphones

proceeds, advancements in information andand public wireless networks, every people arecommunication technologies such as AI and VR

connected to cyberspace and enjoys theare making it possible to share diverse

significant benefits thereof. This trend is expected

experiences including the processes by whichto accelerate with the advancement of IoT.

they are formed, while acknowledging the

Meanwhile, for the safe and secure use ofdifferent values of each individual. Amid thecyberspace on a continuous basis amid the

major changes to humanity brought about by

spreading threat of cyberattacks, it is essential forthese technologies, there is a possibility that theeach and every people as an active agent incurrent received logic of social systems will

cyberspace to cultivate their awareness andfundamentally change in the future, and there

understanding of cybersecurity so that they canwill be a limit to what can be done with thedeal with various risks in cyberspace in the same

existing approach of cybersecurity R&D thatmanner as the measures for crime prevention andextrapolates from the evolution of technology so

traffic safety in real space, so that they can use

far. In order to generate new value, it is likely thatcyberspace safely and securely.

a new approach will become necessary that

For cultivating this awareness and understanding

designs overall society from the standpoint of theof cybersecurity, there is a limit to theecosystem, which humans are part of, looking

effectiveness of existing campaign initiatives

ahead the future from the present where thecarried out by the state alone. Rather, thecontinued unification of cyberspace and real

government is required to build a system thatspace is taking place. To that end, with a view toenables stakeholders to collaborate and cooperate

mid- and long-term, the government will promoteaccording to their mutual division ofresearch on coordination and unification between

responsibilities while respecting the autonomous

cybersecurity various academic disciplines,

activities of various communities such as regions,

including social scientific perspectives from thecompanies, and schools, and to exercise its

disciplines such as law and international

leadership through the approach to support such

relations, national security, and businesssystem.

administration, and also the humanistic andAccordingly, with the National center of Incident

sociological perspectives from the disciplines

readiness and Strategy for Cybersecurity playing

including philosophy and psychology. It goes

the key role, the government will enable

without saying that the results of R&D, including

stakeholders in industry, academia, and the

R&D in the fields of science and technology, must

public and private sectors to operate smoothly

not impact human society in a negative way.

and effectively and collaborate organically.
Specifically, it will develop a comprehensive
strategy and specific action plan for publicawareness on cybersecurity and disseminate
necessary information and handle inquiries by
the people. The government will also promote
practical action by the stakeholders by utilizing
Cybersecurity Strategy

53

committees in which representatives of various
communities in industry, academia, and the
public and private sectors participate. The
government will also work to further enhance
Cybersecurity Awareness Month as a period toconcentrate on promoting the understanding ofcybersecurity by each and every people. It will
also promote cybersecurity education throughthe creation and distribution of easy-tounderstand guidebooks for people and throughthe development of the ability to utilize
information through school curriculums.
Manufacturers and sellers of devices such as
smartphones and personal computers andtelecommunications companies such ascommunications carriers and Internet providers
are expected to enable users to carry out
cybersecurity initiatives appropriately byproviding security-friendly products and services
and by explaining to users and responding totheir inquiries. For this reason, the government
will develop an environment that promotes
initiatives by these businesses and relatedorganizations and promote the development andsteady implementation of guidelines useful to theestablishment of cybersecurity based on userneeds and usage forms.

54

Cybersecurity Strategy

Promotion and Implementationof Cybersecurity
The Government has been promoting a policy of

implementation of cybersecurity measures byimproving cybersecurity measures to secure thebuilding up schemes of involvement, partnership,

use and application of information andand collaboration of the industrial, academic,

61

communication technologies and data as the62

socio-economic foundation of society and toensure Japan’s national security.

63

government, and community sectors.
The Cybersecurity Strategic Headquarters willclosely work with the Strategic Headquarters for

Under this policy, relevant governmental bodies

the promotion of an Advanced Information andshould play their active roles in promoting

Telecommunications Network Society when it

cybersecurity measures, while making themworks on critica l cybersecurity issues. The

consistent as a whole. For this purpose, theheadquarters will collaborate and sharerelated government bodies will keep working on

information with the crisis management organs,

improving their cybersecurity capabilities underincluding a headquarters for emergency response

the leadership of the National center of Incident

to terrorism, when established, and takereadiness and Strategy for Cybersecurity to ensure

appropriate actions concerning national security,

steady implementation of the measuresin close coordination with the National Security

stipulated in this strategy. The National center ofCouncil.

Incident readiness and Strategy for Cybersecurity

Furthermore, the headquarters will respond towill play its leading role as the focal point inissues concerning national security in close

coordinating intra-government collaboration andcoordination with the NSC. In such cases, thepromoting partnerships between industry,

relevant governmental bodies will work together

academia, and the public and private sectors

under the overall coordination by the National

while disseminating this strategy to relevant

Security Secretariat.

parties in Japan and abroad. The Government will

The Cybersecurity Strategic Headquarters willfurther reinforce its crisis management andestablish a budget prioritization policy and seek

response capabilities. In connection with theto secure and execute the budget necessary forupcoming Tokyo 2020 Games, particular

the government so that the measures of theconsideration should be given to steadyrespective Agencies are steadily and effectively

61

The Declaration to be the World’s Most Advanced IT Nation: Basic Plan for the Advancement of Public and Private Sector Data
Utilization (May 30, 2017) specifies that “In promoting the use and application of data, it goes without saying that measures should
be concurrently carried out in connection with the protection of personal information and privacy, cyber-security measures,
intellectual property rights, data quality and efforts to ensure the reliability and security of data, the state of logic in the era of AI
and robots, and more”.

62

Growth Strategy 2017 (Cabinet decision on June 9, 2017) states that “In the super smart society where people can live comfortably
and abundantly in all situations, securing a safe cyber space is an important foundation for economic and social activities in Society
5.0.”

63

The National Security Strategy (Cabinet decision on December 17, 2013) states that “cyberspace is necessary for promoting both
economic growth and innovation through the free flow of information in cyberspace. Protecting cyberspace from the abovementioned risks is vital to secure national security.”
Cybersecurity Strategy

55

executed in accordance with the principles
stipulated in this strategy. The headquarters will
also encourage the collaboration between the
public and private sectors to pursue effective
intelligence and analysis capabilities, as well asmechanisms for flawless cycle of early detection,
analysis, judgment and handling of cyberattacks.
Going forward, in order to implement thisstrategy in an accurate manner, the Cybersecurity
Strategic Headquarters will set forth annual plansincluding the attached list of Agencies in chargeduring the three-year implementation period of
this strategy, and the Agencies will steadily
implement the measures on its basis. The
headquarters will also review the status ofprogress of these measures, compile this as anannual report, and reflect it in the annual plan for
the following year. Furthermore, since thesituations and technical premises regarding
cyberspace may evolve in a discontinuous
manner, the strategy itself may be flexibly
reviewed when necessary irregardless of thescheduled duration of the plan.

56

Cybersecurity Strategy