Overview of Cybersecurity Policy for CIP
Promotion of critical infrastructure protection through public-private partnerships- Achieve safe and sustainable provision of critical infrastructure services based on the concept of mission assurance- Promote public-private partnership activities to ensure cybersecurity of critical infrastructure.

Comprehensive coordination by NISC
Responsible ministries for CIP● Financial Services Agency[Finance]● Ministry of Internal Affairs andCommunications[Information and communication,
Administration]● Ministry of Health, Labour and Welfare[Medical]● Ministry of Economy, Trade and Industry[Electric power supply, Gas supply, Chemical
inductries, Credit card, Petroleum industries]● Ministry of Land, Infrastructure, Transport andTourism[Aviation, Airport, Railway, Water, Logistics,
Ports and harbours]

Critical Infrastructure (15 sectors in total)●Information & communication●Government & administration●Finance●Medical●Aviation●Water●Logistics●Airport●Chemical industries●Railway●Electric power supply●Gas supply●Credit card
●Petroleum
industries●Ports and harbours

Related organizations, etc.
● Cybersecurity related ministries[Ministry of Internal Affairs and Communications,
Ministry of Economy, Trade and Industry, etc.]● Crisis management ministries[National Police Agency, Ministry of Defense, etc.]● Disaster prevention related ministries[Cabinet Office, ministries and agencies, etc.]● Cybersecurity related agencies[NICT, IPA, JPCERT/CC, etc.]● Cyberspace-related business entities[Vendors and others involved in the supply chain,
etc.]

Main activities in the Cybersecurity Policy for CIP
Enhancement of Incident
Response Capability

Maintenance and Promotion of the
Safety Principles

Enhancement of Information
Sharing System

Utilization of Risk Management

Enhancement of theBasis for CIP

Promote the enhancement of incident
response capability as part of theorganizational governance so that theentire organization, including top
management, CISO, strategic
management, and system staff, etc. are
involved in the activities.

Promote continuous improvementof guidelines for necessary crosssectoral measures in criticalinfrastructure protection and safety
principles, etc. in each sector.

Further enhance the public-private
and internal-external sectorial
information sharing system.

Identify the characteristics of own
organization and use risk
management to ensure thatappropriate protection measures arecontinuously implemented.

Raise the overall level ofcybersecurity by promoting crossfield exercises, international
cooperation, and public relations
and public information activities.

1

Executive Summary of Cybersecurity Policy for CIP
1. Purpose of CIP
Based on the concept of mission assurance, the purpose of CI protection (CIP) is to maintain safe and continuous provision of CISs by
ensuring resilience and preventing serious impact on national life and socioeconomic activities from the dual aspects of below;• Limit risk to acceptable levels taking the view that natural disasters, mismanagement, cyberattacks, and changes in the environment
surrounding CI constitute risks that make the continuous provision of CISs uncertain.
• Take appropriate action in the event of outages and ensure rapid restoration of services in terms of preparing for CISs outages.

2. Responsibilities of stakeholders••••

Responsibilities of stakeholders are based on the Basic Act on Cybersecurity (Act No. 104 of 2014).
The national government is responsible for formulating and implementing comprehensive cybersecurity policies.
Local governments bear the responsibility to formulate and implement independent cybersecurity policies.
CI operators (excl. related entities) bear the responsibility to deepen their interest in and understanding of the importance ofcybersecurity and to endeavor independently and actively to ensure cybersecurity, in order to stably and properly provide its
services.
• Cyberspace-related business entities and other business entities shall endeavor independently and actively to ensure cybersecurity
in the course of their business activities.

3. Basic concept• In response to the increasingly sophisticated and complex usage of systems and the rapidly increasing threats in cyberspace, CI
operators will further promote organization-wide responses, involving top management, CISOs, strategic management, andsystem personnel. Particular measures will be taken towards promoting cybersecurity as an important priority for management.
• CI operators will clarify the specific characteristics of their organization and implement the most appropriate CIP policies byutilizing risk management that organically combines the perspectives of all organizational levels, from top management through tosystem personnel.
• In order to respond precisely to changes to threats relating to CI, a comprehensive response is implemented capable ofanticipating future changes in the environment, including in the supply chain, etc.

4. Enhancement of incident response capability• Enhance incident response capability through a combination of preemptive risk management and crisis management.
• Clarify the relationship between top management and experts for ensuring organizational cybersecurity.
• Based on the definition stipulated in Article 2 of the Basic Act on Cybersecurity, to ensure cybersecurity develop and operate anincident response system capable of responding not only to external attacks, but also to events related to system procurement,
design, and operation.

2

Policy Group (1): Enhancement of Incident Response Capability
Critical infrastructure operators, etc. will promote the enhancement of their incident response
capabilities through close mutual cooperation between the public and private sectors, after making
their organization-wide efforts to ensure cybersecurity.
Key points of activities

 Development of incident response capability as part of theorganizational governance Comprehensive response, including supply chain

Enhancement of Incident Response Capability
Critical infrastructure operators, etc.
Top management, CISO
- Determination of cybersecurity structure and basic
policies- Understanding of the impact of IT failures on businesses- Disclosure of cybersecurity activities

Activities during this Cybersecurity Policy term
(1) Incident response capability as part of organizational
governance• Promote the enhancement of incident response capability of theentire organization, including top management, CISO, strategic
management, and system personnel, etc., and operators involvedin the supply chain, etc.
(2) Activities to enhance incident response capability

Give
instructions

Penetration ofprinciples, etc.
Instruction andtraining of the system

Current
statusreportInformation
sharing/reporting

System personnel- Contact with information on system failures, etc.
- Implement control measures to eliminate threats andvulnerabilities discovered- Implement training to deal with failures, etc.

• Promote effective activities for BCP/IT-BCP, CSIRT, audit system,
etc. to enhance the incident response capability(3) Integrated public-private efforts to enhance incident
response capability• Consider integrated public-private efforts with close mutual
cooperation between the government and critical infrastructure
operators, etc.
(4) Review of the protection scope of CI• Ensure "protection as plane" including the supply chain and froma security perspective in order to respond to changes in theenvironment

Strategic management- Analysis and verification of safety principles, etc. of own
organization- Development of BCP/IT-BCP- Establishment and operation of the response systems(CSIRT, etc.)- Utilization of risk management- Implementation of audits of own organization and use of
the results

Contact with information
about system failures,etc.

Supply chain
management

Cyber-related
operators, etc.

Support for activities
Review of the protection scope, etc.
Internal-external sectorial
information sharing

CEPTOARs and
CEPTOAR Secretariat, etc.

Government agencies, etc.
Cabinet Secretariat (NISC)
Responsible ministries for CIP
Responsible ministries for cybercecurity

Crisis management ministries
Disaster prevention related ministries

3Policy Group (2): Maintenance and Promotion of the Safety Principles
In order to implement the most appropriate protection measures for own organizations, promote
activities for the maintenance and promotion of the "safety principles, etc." by the stakeholders such
* Safety principles, etc.: General term for relevant laws, industry standards/guidelines, internal regulations, etc.
as critical infrastructure operators.
Key points of activities
 Develop safety principles, etc. appropriate to own
organization, adapting to social trends and changes in thesurrounding environment.
 Make continuous improvement of safety principles, etc.
through risk assessment by audits, exercises, etc.

Activities during this Cybersecurity Policy term
(1) Continual improvement of the Guidelines for Safety
Principles

Continuous improvement of Safety Principles, etc.
Cabinetdecision

 Cybersecurity Strategy

Determination ofCybersecurity
Strategic
Headquarters

Cybersecurity Policy• Develop principles for continuous improvement optimized to own
organization• Continuous improvement of safety principles, etc. through risk
assessment by internal and external audits, participation in
exercises, etc.
• Survey on the status of improvement of safety principles, etc. by
responsible ministries for CIP(3) Penetration of the safety principles• Survey to ascertain the actual status of activities to ensure
cybersecurity by the critical infrastructure operators, etc.
(4) Clarification of documentation relating to the safety
principles• Listing of documents and clarification of relationships between
documents to promote understanding of the Guidelines for Safety
Principles, safety principles, etc.

Responsible ministries for CIP,
critical infrastructure operators, etc.

(Article 12 of the Basic Act)Continuous improvement ofsafety principles, etc.

(Article 14 of the Basic Act)• Enhance measures to incorporate cybersecurity as part oforganizational governance and develop principles for supply chain(2) Continuous improvement of the safety principles

Basic Act on Cybersecurity

Legislation

Guidelines for Safety Principles

Plan

Do

Act

Check

 Manuals
CabinetSecretariat

 Guidance
Responsible ministries for CIP

Reference• "Principles" and "guidelines" established by responsible ministries for CIP based on
relevant laws and regulations

Critical infrastructure operators,
etc.

Reference• Cross-industry "industry standards" and "guidelines" established by the industry
associations, etc.
• Internal regulations, etc. established by critical infrastructure operators, etc.

Safetyprinciples, etc.

[Safety principles, etc.]• "Mandatory principles" stipulated by the government in compliance with relevant laws
• "Recommendations" and "guidelines" stipulated by the government according to relevant laws
• "Industry standards" and "guidelines" in the whole-sector developed by sector-specific groups torespond to relevant laws and public expectations• "Internal regulations" prepared by critical infrastructure operators and others themselves to
respond to relevant laws and expectations of public and customers

4Policy Group (3): Enhancement of Information Sharing System
Work to enhance public-private and internal-external sectoral information sharing systems further sothat individual critical infrastructure operators, etc. can respond to cybersecurity trends that change
on a daily basis.
Key points of activities

Information Sharing Systems in the Critical Infrastructure Develop and disseminate the information sharing systems
built under the previous policies.
 Activate voluntary efforts by critical infrastructure operators,
etc.

Disaster/damage
information

Cabinet Secretariat (Situations Response &Crisis Management Cabinet Secretariat)
National center of Incident readiness andStrategy for Cybersecurity (NISC)

Terrorism-related
information
Misc. related
information, etc.

Request forcooperation

Activities during this Cybersecurity Policy term

Attack method
information
Recovery method
information

Early warning information(1) Further promotion of information sharing

Recovery method information• Proactive utilization for risk management of shared information• Timely and appropriate review in the event of environmental changes,etc.

• Establishment and enhancement of the incident response capability
under the leadership of top management• Further enhancement of information sharing within and between
CEPTOARs• Promotion of participation in ISACs and information sharing among
ISACs• Implementation of CEPTOAR training in a more realistic manner

Crisis management
ministries
Cybersecurity related
ministries
Cyberspace-related
business entities
Cybersecurity related
agencies

Critical infrastructure
sectors
CEPTOAR Council

Report of criminal damage, etc.

Early warning information
Recovery method information
Misc. related information, etc.
Signs and Hiyari-Hatto
events, etc.
(events for which reporting
is not a legal requirement)* May be shared after being
anonymized.

CEPTOAR 1(2) Promotion of CI operators’ activities

Misc. related
information, etc.
Signs and HiyariHatto events, etc.,
at business
operator

Responsible ministries for CIP• Aggregation, analysis and sharing of information related to criticalinfrastructure service outages and threat and vulnerability information• Clarification of what information should be shared (Clarify that not only
information systems but also control systems and IoT systems should
be covered, and so on.)Outage and attack information, etc.

Misc. related information, etc.

Disaster prevention
related ministries

Early warning
information
Outage and attack
information
Recovery method
information

Hotline(in an emergency, etc.)

Request for cooperation
Attack method information
Recovery method information
Misc. related information, etc.

Critical infrastructure service
outages- System failures, etc.
(events for which reportingis a legal requirement)

CEPTOAR 2

Misc. related
information, etc.

CEPTOAR X CEPTOAR
Secretariat (Each sector’s
industry group, etc.)

Outage and attack info, etc.

Company A

Company B

Company C

Company D

5Policy Group (4): Utilization of Risk Management
Aiming to ensure resilience in the continual provision of critical infrastructure services, promote
continuous efforts in repeated PDCA cycles of protection measures optimized to individualorganizations.
Key points of activities Realization of protection measures optimized to individualorganizations
 Identification of new risks and risk sources due toenvironmental changes
 Analysis of interdependency among critical infrastructure
sectors

Utilization of Risk Management

Identification of risks inenvironmental changes

Directions for the realization of protection
measures optimized to individual organizations
Realization of protection measures optimized toindividual organizations

Environmental change studies

Formulation of new guidance, etc.

Interdependency studies

Risk assessment(Identification, analysis
and evaluation)

Monitoring and review(2) Studies and analysis of risks• Implementation of environmental change studies toaddress risks due to the transformation of cyberspace as aresult of the advancement of DX with digitalization, etc.
• Implementation of interdependency studies of which othercritical infrastructure sectors would be affected in the eventof a critical infrastructure service outage

Understanding ofcharacteristics of organization

Risk communication(1) Promotion of risk management• Clarification of the profile of own organization andpromotion of efforts to realize protection measures
optimized to individual organizations• Review of the effective measures and usage of existing
principles, review of manuals and development of new
guidance, etc.

Response to risks

Risk management activities by criticalinfrastructure operators, etc. (examples)

Activities during this Cybersecurity Policy term

Continuation of risk management activities to date
Organization of perspectives on auditing, etc.
Provision of opportunities for risk communication
Usage of the legacy of the Olympic Games and theParalympic Games

6

Policy Group (5): Enhancement of the Basis for CIP
In order to strengthen the basis for CIP, promote activities which support the entirety of the policy, such asverification of the effectiveness of the incident response capability, human resources development, cooperation withrelated agencies, international cooperation, public relations activities.
Key points of activities

Implementation of effectiveness verification of incident response
capability



Development of human resources not only in the IT sector but also in awide range of other sectors

Information dissemination through effective PR channels, etc.

Activities for the Enhancement of Basis for Critical Infrastructure Protection
Verification of effectiveness of incident response capability

Advancepreparation

After-the-fact
improvement

Day of exercise

Activities during this Cybersecurity Policy term

IT Department,etc.

(1) Verification of effectiveness of incident response capability• Verification of incident response capability through cross-sectoral exercise

IT Department,etc.

• Improvement of incident response capability by using the issues from theexerciseOrganize and improveissues and risks in own
organization(2) Promotion of the development of human resources

IT Department,etc.

A division

C division
B division

Verify that the incident response capability functions effectively

Development of Human resources.

• Develop strategic management personnel to work closely with top
management

Improve issues
identified in theexerciseInternational cooperation• Raise awareness throughout the organization, not just in the IT department(3) Promotion of international cooperation• Promote diversified and multilateral international cooperation by using
various frameworks between the government and businesses(4) Strengthening of cooperation with the National PoliceAgency
and the Digital Agency• Promote overall security by raising awareness of cybercrime and newtechnologies associated with DX••

Develop strategic management
Raise awareness throughout theorganization

Strengthening of cooperation with
the National Police Agency and theDigital Agency(5) Promotion of public relations activities• Making the framework and activities of the policies easy to understand forthe public• Maintenance of relevant documents and standards

Cooperation between two countries andregions and among countries

Public relations activities

Web

•
•

Reporting cybercrimes to the police, etc.
Securing of cyberspace security throughraising the awareness for new technologies
associated with DX

LectureSNS

Newsletter

Dissemination through website, social media,
newsletter, lectures, etc.

7

“Critical Infrastructure Operator Measure Examples” and “Government Activities”
Understanding of the responsibilities of stakeholders under the Basic Act on Cybersecurity

Utilization of risk management
・Clarification of organizational profile ・Analyze differences
between requirements and actual situation ・ Identify items for
improvement ・ Consider and set priorities for prevention measures

BCP, Contingency Plans
Information handling

Operation of cybersecurity measures(recognizing attack trends, etc.)
Public announcement of the status ofcybersecurity measures

Issue identification through operationof cybersecurity measures
Issue identification throughinternal/external audits
Issue identification through results ofresearch/analysis of environmental
changesIssue identification through exercises andtraining

Protection/recovery from CISs outages

Design/implementation/maintenancerelated to technological measures forcybersecurity

Design/procedure manual
creation/maintenance related to operational
cybersecurity measures

OutagesEstablishment / revision of plan forcybersecurity

Establishment

Planning

Establishment / revision of roadmap forcybersecurity

Internal rules(Cybersecurity policy, etc.)

Execution of BCP / contingency
plans,etc.
Public announcement of the status of
measures to respond to CISs outages

Outages

Measures for outsourcing

Management review of operation of
cybersecurity measures
Information sharing by stakeholders

Normalcircumstances

Rulemaking

Securing of budget / personnel
Human Resource development / assignment,
and accumulation of know-how

Operation of cybersecurity measures(monitoring/control)
Normal circumstances

Basic

PolicyDetermination and revision of operator’s basic
policyDevelopment of monitoring, information
sharing and CSIRT structures, etc.

Check / Act (revise)
Identification and fixing issues

Do
Detection and recovery

Positioning cybersecurity as management priority

Resource
management

Critical infrastructure operator measureexamplesPlan
Identification and prevention

Issue identification through CISs outage
responses (detection and recovery)

Enhancement of incident response capabilities
Promotion of incident response capabilities as part of organizational governance / Support for formulation of BCPs, CSIRT operation and audits at operators (Cabinet Secretariat/ Responsible ministries for CIIP)

Integrated public-private efforts to enhance incident response capabilities (Cabinet Secretariat/ Responsible ministries for CIIP / Crisis management ministries, etc.)

Maintenance and promotion of the safety principles

Government activities

Continual improvement of the safety principles
Promotion of the safety principles
Continual improvement of the Guidelines for Safety
Principles (Cabinet Secretariat/ Responsible
ministries for CIIP)(Cabinet Secretariat/ Responsible ministries for CIIP)(Cabinet Secretariat/ Responsible ministries for CIIP)

Enhancement of information sharing
Information sharing among public-private
stakeholders (Cabinet Secretariat/
Responsible ministries for CIIP)

CEPTOAR exercises(Cabinet Secretariat/ Responsible
ministries for CIIP)

Utilization of risk management
Realization of protection measures optimized for individual organizations / promotion of risk communication (Cabinet Secretariat/ Responsible ministries for CIIP)
Awareness of risks arising due to environmental
Dissemination of risk assessmentchange(Cabinet Secretariat/ Responsible ministries for(Cabinet Secretariat/ Responsible ministries for CIIP)
CIIP)

Enhancement of basis for CIIP
Promotion of the developing of human resources, etc. / Promotion of security by design / International cooperation /Cooperation with Digital Agency / Public relations (Cabinet Secretariat/ Responsible ministries for CIIP)

Verifying effectiveness of incident response
capabilities (Cabinet Secretariat/
Responsible ministries for CIIP)
Exercises run by responsible ministries for
CIIP (Responsible ministries for CIIP) ）8

CEPTOAR and CEPTOAR Council
CEPTOAR: Capability for Engineering of Protection, Technical Operation, Analysis and Response Organization responsible for information sharing and analysis functions and relevant functions for critical infrastructure operators.
 For proactive prevention of CISs outages as well as prevention of the spread of damage, prompt recovery, and prevention of recurrence in the caseof CISs outage, CEPTOARs appropriately provide information provided by the Government, etc. to critical infrastructure operators and share
information with stakeholders. CEPTOARs hereby aim at activities that contribute to the improvement of the service maintenance and recovery
capability of each critical infrastructure operator.

CEPTOAR council
 This is a council consisting of representatives from CEPTOARs developed in each critical infrastructure sector. It shares information between
CEPTOARs. It is an independent meeting structure that is not positioned under any other organizations including government organizations.
 The council was founded on February 26, 2009, with the purpose of promoting cross‐sectoral information sharing.
Generalassembly
Image of CEPTOAR

Steering committee
WG

Random order

WG

CompanyA

WG‐ Steering committee conducts comprehensive planning and management of
CEPTOAR council;‐ WG is established as necessary

Company
B

CompanyD

General assembly observers
Random orderCompanyC

CompanyE

CompanyF

Criticalinfrastructure operators

Japan Federation of Economic Organizations
Bank of Japan
Center for Financial Industry Information Systems

Japan Post Bank Co., Ltd.

CEPTOAR(Information & communication
services sector: Communication)

CEPTOAR(Information & communication
services sector: CATV)CEPTOAR(Information & communication
services sector: Broadcasting)

CEPTOAR(Financial services sector:
Banking)

NICT

CEPTOAR(Financial services sector:
Securities)

CEPTOAR(Financial services sector:
Life insurance)

CEPTOAR(Financial services sector:
General insurance)

CEPTOAR(Financial services sector:
Payment)

JPCERT/CC

CEPTOAR
(Aviation services sector)

CEPTOAR(Electric power supply services
sector)

CEPTOAR(Gas supply services sector)

CEPTOAR(Government & administrative
services sector)

MIC

CEPTOAR(Water supply services sector)

CEPTOAR(Logistics services sector)

CEPTOAR(Chemical services sector)

CEPTOAR(Credit card services sector)

CEPTOAR(Petroleum industries sector)

CEPTOAR(Railway services sector)

CEPTOAR(Medical services sector)

CEPTOAR(Airport services sector)

IPA

FSA

MHLW
METI
MLIT

As of April 21, 2023

The list of CEPTOARs
As of September 30, 2023
■ CEPTOAR
CI
Sectors

Information and communication

Services

Telecommunication

Broadcasting

Financial

Banking

Securities

Life
insurance

Generalinsurance

Payment

Aviation

AirportRailway

ElectricPowersupplyGas supply

Government
andadministrative

Medical

Water

Logistics

Chemical Credit card Petroleum

Aviation

AirportRailway

ElectricPowersupplyGas supply

Government
andadministrative

Medical

Water

Logistics

ChemicalCredit card

Petroleum

Aviation
services
CEPTOARAirportservices
CEPTOAR

Railway
services
CEPTOARElectric
power
supplyservices
CEPTOARGas supply
Local
servicesgovernment
CEPTOAR

Medicalservices
CEPTOAR

Water
supply
CEPTOAR

Logistics
services
CEPTOAR

Chemicalindustries
CEPTOAR

Credit card
services
CEPTOARPetroleumindustries
CEPTOAR8companies

8communities

Financial service CEPTOAR Liaison Council
Name

T-CEPTOAR

27

Member306

Broadcasting
CEPTOAR

Banking
Securities
services etc. services
CEPTOAR
CEPTOAR194

companies

companies

1

1

2

companies

13

companies
andcommunities

408

companies
andcommunities

community

336

companies

1,276

communities

companies

Life
insuranceservices
CEPTOAR

Generalinsuranceservices
CEPTOAR

Payment
services
CEPTOAR

42

47

193

companies

companies

companies

1

companies

━

━

280

companies
community

Sharing
Scope ofinfo from
NISC(Except
member)

Cable TV
CEPTOARcompanies

７

companies━━

organizations

14

22

community

2━

9companies

12

24

1

companies━

companies
andorganizations

community

companies

1community

21

47

States

1,741

local
governments

196

companies
andcommunities

1

group

21

business units

organizations

398

━

6

companies
andinstitutions

13

51

11

17

companies

companies

companies

━

━

━

━

companies
Spreading to

1,314

business units
as needed

Other (Nuclear material related office, building automation association, cyber defense Council, college)