Japan's Next
Cybersecurity Strategy(Note)
Japan is now revising the current Cybersecurity Strategy 2018 anddecides on its New Strategy by the end of this year. This document shows its
direction and the main elements of its outline discussed at the Cybersecurity
Strategy Headquarters held on May 13, 2021. This outline is now available
only in Japanese and its English provisional translation will get ready soon.
Cybersecurity Strategy 2018https://www.nisc.go.jp/eng/pdf/cs-strategy2018-en-booklet.pdf
Outline of Next Cybersecurity Strategy (Japanese)
https://www.nisc.go.jp/conference/cs/dai28/pdf/28shiryou01.pdf
As of 1 of June 2021

Issues and Direction of the Japan’s Next Cybersecurity Strategy

１Japan in the 2020s: Era of the “new normal” and the digital society
Digital economy
Digital transformation (DX)

Increasingly harshnational security
landscape

COVID-19
Remote working, online education, etc.

Expectations for thecontribution of digitaltechnology to SDGs

Tokyo Games

Issues in cyberspace: Inclusion of all the people in cyberspace
Cyberspace is becoming a public space where all stakeholders participate
Interconnections and interrelationships across cyber and physical boundaries
are becoming deeper
These changes increase vulnerabilities that attackers can exploit

Geopolitical tensions brought
into cyberspace
International competition
National security issues

Concerns about rifts
between nations and the
suppression of human rights

Public and private partnership

Need for all stakeholders to ensure their own cybersecurity
Japan’s Commitment to the 5 basic principles*“Cybersecurity for All”
Cybersecurity which leaves no-one behind

Advancing DX and cybersecurity
simultaneously

Enhancing initiatives fromthe perspective of Japan’s national security

Ensuring the overall safety and security of cyberspace
as it becomes increasingly public and interconnected

Ensuring “a free, fair and secure cyberspace”* Assuring the free flow of information, the rule of law, openness, autonomy, and collaboration among multi-stakeholders

Enhancing Socio-Economic Vitality and Sustainable Development
Issues and direction—DX with Cybersecurity● The Digital Agency will be established in September of this year. Such initiatives will greatly advance DX.
To this end, it is important to build trust in cyberspace, which leads to participation and commitment.
● As operations, products, and services become increasingly digitalized, ensuring cybersecurity will be directly linked to corporate value.
“Security by design” will become ever more important, and digital investments and security measures will likely become increasingly
integrated.
Advance cybersecurity in parallel with digitalization

Specific measures(1) Raising executive awareness→Visualize and incentivize initiatives based on the guidelines of cybersecurity
management, and further promote such initiatives, by implementing guidelines for digitalmanagement.

(2)

(1)

(2) Advancing DX with Cybersecurity among local communities and SMEs
→Address the shortage of knowledge and human resources required for digitalization,
through the development of local communities and the establishment of a registration
scheme for services targeting SMEs.

(3) Building a foundation for ensuring trustworthiness of supply chains→Advance initiatives based on the frameworks which respond to Society5.0.
ー Supply chains: Industry-led consortium
ー Data Flow: Definition of data management, promotion of “trusted services”
ー Security products/services: Promotion of third-party verification services
ー Advanced technology: Building a common foundation for collecting, accumulating,analyzing, and providing information(3)

People-friendly digitalization,with no-one left behind(4) Advancing digital/security literacy inclusively→Advance initiatives which provide assistance in the use of digital technology, along withefforts to drive information education.

(4)

2

A Digital Society where People can Live with a Sense of Safety and Security

3

Issues and direction— Ensuring the overall safety and security of cyberspace as it becomes increasingly public and interconnected● Evolution of cyberspace into a public space where all stakeholders are involved.
● Deepening interconnection and interrelationship of socio-economic activities across cyber and physical boundaries.
● Cyberattacks which are becoming more organized and sophisticated.
The national government, in cooperation with various stakeholders, will take a comprehensive and multilayered approach to
cybersecurity, which is based on self-help, mutual help and public help, and which reduces risks and increases resilience for theentire country.
Specific measures

Self-help, mutual help, public help

○ Ensure cybersecurity combined with digital transformation(led by the Digital Agency)○ Promote efforts by stakeholders which underpin the socioeconomic infrastructure1) Government agencies, etc.
2) Critical infrastructure3) Universities, education and research institutions, etc.
○ Promote seamless information sharing among multiple
stakeholders and make good use of knowledge gained
through the Tokyo Games, etc.

Self-help Self-help

Self-help

Mutual help
Self-help
Self-help

Public space

Mutual help
Public help
Self-help

Self-help Self-help○ Enhance readiness to respond to massive cyberattacks,etc.

○ Cybersecurity environment to protect people and society
Ensure safety and security incyberspace through(1) Supply chain management(2) Responses to newtechnologies and services (e.g.,
IoT, 5G)

Cooperate with new providersof cybersecurity(Efforts to enable users to use
cyberspace technologies andservices, including cloudservices, safely and securely)

Address cyber crimes

Deploy comprehensive cyberdefense(Improvement of response
capabilities by enhancing national
CSIRT functions and enhancing
interagency collaboration in theevent of incidents.

Ensure trustworthiness ofcyberspace(1) Protection of personal informationand intellectual property information(2) Ensuring “trustworthiness” of IT
systems and services from theperspective of economic security

Contribution to the Peace and Stability of the International Community and Japan’s National Security

4

Issues and direction—Enhancing initiatives from the perspective of national security

The national security environment surrounding Japan has become increasingly harsh, and cyberspace has become
an area of competition that reflects geopolitical tensions. China, Russia and North Korea are apparently building andstrengthening cyber capabilities, and sponsoring cyberattacks.
Like-minded countries are working together to defend against such cyberattacks and tackle conflicts overinternational rules concerning cyberspace.
To ensure the safety and security of cyberspace, we will raise the priority of cyber in diplomacy and national
security. We also commit to (1) promoting the rule of law, (2) strengthening capabilities for defense,
deterrence, and situational awareness against cyberattacks, and (3) further enhancing international
cooperation and collaboration.
Specific measures(1) Commitment to a free, fair and secure cyberspace
Advance the rule of law in cyberspace through activities at the UN and elsewhere
Formulate international rules in line with Japan’s basic vision(2) Strengthening Japan’s capabilities for defense, deterrence, and situational awareness
Build stronger cyber units in MOD, maintain security of critical technologies and industries, and strengthen alliance with the US
Further fact-finding with regards to cyberattacks by leveraging nationwide network technology units(3) International cooperation and collaboration
Strengthen multi-layered frameworks for international collaboration within and across ministries and agencies
Promote joint efforts by the government, industry, and academia to build capabilities in the Indo-Pacific region, including ASEAN

5

Cross-Cutting Approaches to Cybersecurity
Advance DX and cybersecurity
simultaneously

Ensure the overall safety and securityof cyberspace as it becomesincreasingly public andinterconnected

Enhance initiatives
from the perspective of national
security● Taking a cross-cutting, medium- to long-term view, promote R&D, development of human resources, and awareness-raising activities inorder to advance the above.

1. Advancement of R&D
Build a government-industry-academia ecosystem, and pursue practical R&D using that as afoundation.
Take medium- to long-term technological trends into consideration.

(2) Advance practical R&D

2. Recruitment, development, and active use of humanresources
Develop the quality and quantity of public and private sector, with a focus onefforts to address environmental changes. Create an environment that enables
career development spanning both public and private sectors.
(1) Advance DX with Cybersecurity(1) Address supply chain risks(2) Cultivate/develop domestic industries- Create an environment where people cangain additional security knowledge(4) Advance research of cryptography, etc.

- Promote practices which encouragefunction building and staff mobility, etc.
(xSIRT, side/concurrent business, etc.)(3) Take medium- to long-term(3) Monitor/analyze attacks and their common technological trends into
consideration
foundations(1) Advancement of AI technology
AI for Security / Security for AI(1) Strengthen international competitiveness (2) Advancement of quantum technology,
Build a government-industry-academia post-quantum cryptography, quantum
communications/cryptography
ecosystem- Leverage measures to promote research andgovernment-industry-academia collaboration- Enhance research environment, etc.

3. Collaboration based on full participation and awareness raising(2) Address increasingly
sophisticated and complex threats- Strengthen human resources development
programs
SecHack365/CYDER/enPiTICSCoE Core Human Resource Development
Program, etc.
- Build a common foundation for humanresources development and make it available
to industry and academia- Promote the use of qualification systems, etc.
Create an environment that enables talented human resources to develop careerswhich span the private sectors, municipalities, and government agencies(3) Pursue government agency initiatives* Update the “Enhancement Policy”
in the first half of FY2021

Improve and review action plans to advance digitalization.

6

Implementation Framework● A concerted effort by the whole of government is needed to promote and implement cybersecurity policy in order to ensure a free, fair and secure cyberspace in line with Japan’s cybersecurity policies.
Further efforts will be made to strengthen the capabilities and collaboration of relevant bodies so that they can contribute to the digital transformation led by the Digital Agency, and leverage the limited
resources of public institutions to fulfill their roles.
● NISC and relevant ministries and agencies must work together to actively communicate this strategy to stakeholders both in Japan and abroad, in order to encourage Japanese stakeholders to take practicalaction based on the recognition of the importance of international cooperation, and with the goals of increasing international understanding of Japan’s stance and enhancing deterrence against attacks.
● Building on the information collection and analysis function, discuss the system needed to enhance the ability to quickly detect, analyze, assess, and address cyberattacks in an integrated cycle.
● Annual reports and plans should be discussed in an integrated manner, and activities for the next year aligned with the results and evaluation of the previous year’s activities, in order to develop a cohesiveflow of activity which is in line with the strategy.

Prime Minister

CabinetCybersecurity Strategic Headquarters
National Security Council(NSC)
Deliberates on important
issues regarding national
security.

Chair:
Chief Cabinet Secretary
Deputy Chair: Minister of state in charge of affairs concerning the Cybersecurity Strategic Headquarters
Members:
Chairperson of the National Public Safety Commission
Minister in charge of digital affairs *1
Close
Minister for Internal Affairs and Communications Minister for Foreign Affairs
collaboration
Minister of Economy, Trade and Industry Minister of Defense
Minister in charge of the Tokyo Olympic and Paralympic Games
Experts (8 persons; no more than 10 persons)Critical Infrastructure
Expert Panel<Competent Ministries of Critical Infrastructures>
Financial Services Agency
Ministry of Internal Affairs and Communications
Ministry of Health, Labour and Welfare
Ministry of Economy, Trade and Industry
Ministry of Land, Infrastructure, Transport and Tourism

Human Resources Expert Panelfor Dissemination andEnlightenment

Cybersecurity Measures
Promotion Committee(CISO, etc. liaison committee)

Close Collaboration

Collaboration*1

Promotes digital transformation as aleader toward the creation of a digitalsociety.

Cybersecurity
Council(Secretariat)

National center of Incident readiness and Strategy
for Cybersecurity (NISC)

Cooperation<Relevant Ministries>
Ministry of Education, Culture, Sports, Science andTechnology, etc.

Technological Strategy
Expert Panel

Digital Agency

Government Security
Operation Coordination Team
(GSOC)

Critical infrastructure
operators, etc.

Cyber Incident
Mobile Assistant Team(CYMAT)

Ministries under HQ Members

National Police Agency
Digital Agency*1
Cooperation Ministry of Internal Affairs and Communications
Ministry of Foreign Affairs
Ministry of Economy, Trade and Industry
Ministry of Defense

Government organizations(*1) Stated based on the bill to establish a basic act on the creation of a digital society (approved at a Cabinet meeting on February 9, 2021), etc.

Companies

Rapid sharing of information that helps
ensure cybersecurity at an early stage
through mutual collaboration between
multiple stakeholders in the public andprivate sectors, etc.

Individuals

Outline of the Next Cybersecurity Strategy
1 Japan in the 2020s
1-1 Establishment of the digital economy and promotion of digital transformation, expectations for contribution to SDGs, changing national security environment,
impact and experience of COVID-19, and application of efforts toward the Tokyo Games.

2 Basic concept
2-1 Ensuring a cyberspace which is “free, fair and secure”
2-2 The basic principles adhere to the 5 principles set forth in the previous strategies(assurance of the free flow of information, the rule of law, openness, autonomy, and collaboration among multi-stakeholders)

3 Issues surrounding cyberspace
3-1 Increasing risks in cyberspace- Spread of and increased reliance on new technologies, wider use of cloud services and technologies which transcend the borders of national security, increased
complexity of supply chains of systems forming cyberspace, manifestation of potential vulnerabilities for attackers to target such as gaps in literacy and shortage or
uneven distribution of human resources, and international situation surrounding cyberspace
3-2 Challenges and direction—Cybersecurity for All- Promotion of DX and cybersecurity simultaneously, ensuring the overall safety and security of cyberspace as it becomes increasingly public and interconnected,
and enhancing initiatives from the perspective of national security

4 Policy approaches
Enhancing Socio-Economic Vitality andSustainable Development
1. Raising executive awareness2. Promotion of DX with Cybersecurity among local
communities and SMEs
3. Building a foundation for ensuring trustworthiness of
supply chains
4. Establishing digital/security literacy inclusively

Realizing a Digital Society where People can Livewith a Sense of Safety and Security
1. Providing a cybersecurity environment which protects people and society
2. Ensuring cybersecurity while pursuing digital transformation (led by the
Digital Agency)
3, 4, 5. Promoting efforts by stakeholders which underpin the foundationsof the economy and society(1) (Government agencies, etc.)(2) (Critical infrastructure)(3) Universities, education and research institutions, etc.
6. Use of seamless information sharing systems run by multiple
stakeholders and application of knowledge gained through efforts
toward the Tokyo Games, etc.
7. Enhancement of readiness to respond to massive cyberattacks, etc.

Contribution to the Peace and Stability of theInternational Community and Japan’s National Security
1. Commitment to “a free, fair and secure cyberspace”
2. Strengthening Japan’s capabilities for defense,
deterrence, and situational awareness3. International cooperation and collaboration

Cross-Cutting Approaches to Cybersecurity
Promotion of R&D
5 Implementation
Framework

Recruitment, development, and active useof human resources

Collaboration based on full participation andawareness raising

A concerted effort by the whole of government is needed to promote and implement cybersecurity policy in order to ensure a free, fair and secure cyberspace in line withcybersecurity policies.
Further efforts will be made to strengthen the capabilities and collaboration of relevant agencies so that they can contribute to the digital transformation led by the Digital Agency,
and leverage their limited resources to fulfill their roles.

7