CYBERSECURITY
STRATEGY

The Government of Japan
September 2015

PREFACE
An "interconnected and converged information society" – a society where all kinds of "things" are connectedto the Internet and the integration of cyberspace and physical space has become intensified – has arrived.
We now live a digital life closely related to cyberspace more than ever before. In such a society, the assuranceof the security in cyberspace, namely, cybersecurity, is not only mission-essential infrastructure to promote
IT utilization and fulfill the Growth Strategy, but also an extremely critical challenge to national security andcrisis management.

As Japan will host major international events, including the 42nd G7 Summit in the Ise-Shima regionin 2016 and the Games of the XXXII Olympiad and the Tokyo 2020 Paralympic Games, it is the upmost

necessity, for their success to be achieved, to take all feasible measures to ensure cybersecurity. Under
these circumstances, as the guiding principles of Japan's cybersecurity policies, Japan has established the"Cybersecurity Strategy," pursuant to the Basic Act on Cybersecurity.

This strategy urges a shift in mindset, from a fixed notion of cybersecurity assurance as an inevitable"cost" to an "investment" to produce safe and secure products and services and to increase corporate
values and international competitiveness. Indeed, cybersecurity is pivotal to Japan's sustainable growth.

Due to a yearly rise in cyber attacks and the evolving methods of cyber attacks, －organized, sophisticated,and possibly state-sponsored－, it is anticipated that threats against the people's lives would become
more serious in the future. Protect valuable personal information and properties of the people, create
an environment for the people's affluent living, ensure Japan's national security, and play a leading role
for maintaining peace and stability of the international community – these are, among others, the mostcritical responsibilities of the Government. The Government of Japan is determined to firmly take actions
to achieve the objective set forth in the "Cybersecurity Strategy."

It is my sincere hope that the people of Japan as well as the people of other countries will develop a better
understanding of the importance of cybersecurity assurance and the directions of Japan's cybersecurity
policies.

Shinzo Abe

Prime Minister of Japan

Cybersecurity Strategy 1Contents
Ⅰ. Executive Summary

P.3

Ⅱ. Cybersecurity Strategy

P.11

1

Introduction

P.12

2

Understanding on Cyberspace

P.14

3

Visions and Objective

P.16

4

Basic Principles

P.19

Policy Approaches towards
Achieving the Objective

P.22

6

Promotion and Implementation ofCybersecurity

P.56

7

Plan Process and Review

P.59

2.1. Benefits of Cyberspace
2.2. Increasing Threats in Cyberspace

4.1. Assurance of the Free Flow of Information
4.2. The Rule of Law
4.3. Openness
4.4. Autonomy
4.5. Collaboration among Multi-stakeholders

55.1. Improving Socio-Economic Vitality and Sustainable Development
5.2. Building a Safe and Secure Society for the People
5.3. Ensuring Peace and Stability of the International Community and National Security
5.4. Cross-Cutting Approaches to Cybersecurity

2 Cybersecurity Strategy

Ⅰ. Executive Summary

Cybersecurity Strategy 3

OVERVIEW●Cyberspace is an artificial domain as a "frontier generating infinite values"
and an essential foundation of Japan's socio-economic activities.

1●The emergence of an "interconnected and converged information society"where all kinds of "things" are networked and the integration of cyberspaceand physical space has become intensified.

Understanding
on Cyberspace●Increasing damage from and social impact of cyber attacks.
●Anticipated further aggravation of cyber threats.
Ensure a free, fair, and secure cyberspace; and subsequently contribute to:2

Visions andObjective

3

Basic
Principles

4

Policy Approaches towards
Achieving the Objective●Improving socio-economic vitality and sustainable development●Building a society where the people can live safe and secure lives, and●Ensuring peace and stability of the international community and national security(1)Assurance of the Free Flow of Information (2)The Rule of Law(3)Openness (4)Autonomy (5)Collaboration among Multi-stakeholders(1)Being proactive, not reactive.
(2)Acting as a catalyst, not just a passive player.
(3)Envisaging cyber-physical space, not cyberspace alone.

Improving Socio-Economic Vitality
and Sustainable Development

Building a Safe and Secure
Society for the People

Ensuring Peace and Stability of
the International Community andNational Security"Cybersecurity is not a cost,
but an investment""Development of cybersecurity
infrastructure for 2020 and further""Proactive contribution topeace in cyberspace"■ Creation of Secured Internetof Things (IoT) Systems■ Measures for the Protectionof the People and Society■ Promotion of EnterpriseManagement with a Security
Mindset■ Measures for Critical
Information Infrastructure
Protection■ Improvement of Cybersecurity
Business Environment■ Measures for the Protectionof Governmental Bodies■ Ensuring National Security■ Maintaining Peace and Stabilityof the International Community■ Cooperation and Collaboration
with Countries around theWorld

Cross-Cutting Approaches to Cybersecurity■ Advancement of Research and Development (R&D)
Promoting R&D to advance detection and defense
capabilities against cyber attacks

5

Promotion and
Implementationof Cybersecurity

4 Cybersecurity Strategy■ Development and Assurance of Cybersecurity Workforce
Developing "hybrid" human resources; conducting practical exercises;
discovering the best brains; building long term career paths●Strengthening coordination and collaboration among industries, academia,
and the public sector, in addition to relevant governmental bodies.
●Ensuring cybersecurity for the Games of the XXXII Olympiad and the Tokyo 2020
Paralympic Games (Tokyo 2020), etc.

【 1.Understanding on Cyberspace 2.Visions and Objective 3.Basic Principles 】

G EN E R A L I S S U E S

Looking towards the Tokyo 2020 and the prospects further ahead for the early 2020s,
this strategy outlines the basic directions of Japan's cybersecurity policies for the coming
three years approximately.

●Significant Benefits:・Free exchange of ideas without being constrained by national borders
・Infinite values generated by intellectual creations and innovations
inspired by the ideas globally exchanged
・Essential foundation for Japan's socio-economic activities

1

Understanding
on Cyberspace●IT "Diastrophism" Provoked by Information and Communications
Technologies Evolution:

With the arrival of the interconnected and converged information society
where physical space and cyberspace have become highly integrated,
all kinds of physical objects and people have become interconnnected without
physical constraints.

●Increasing Cyber Threats:

Cyber threats have become a critical challenge to national security,
having caused significant damages on the people's daily lives
and economic activities. Japan will be certainly exposed to more serious
cyber threats in the future.

2

Visions andObjective●Ensure a free, fair, and secure cyberspace; and subsequently contribute to:●Improving socio-economic vitality and sustainable development●Building a society where the people can live safe and secure lives, and●Ensuring peace and stability of the international community and national security

Japan affirms the following basic principles in policy planning and its
implementation for reaching the strategic objective.

3 Basic
Principles(1) Assurance of the Free Flow of Information(2) The Rule of Law(3) Openness(4) Autonomy(5) Collaboration among Multi-stakeholders
In line with these five principles, and to protect the people's safety,
security, and rights, Japan reserves, as options, all viable and effective
measures, i.e. political, economic, technological, legal, diplomatic, andall other feasible means.

Cybersecurity Strategy 5

【 4. Policy Approaches towards Achieving the Objective 】

SPECIFICISSUE 1

Improving Socio-Economic Vitality
and Sustainable Development"Cybersecurity is not a cost, but an investment"

Creation of Secured Internet of Things (IoT) Systems●Promoting new business harnessing the secured IoT
systems with the idea of "Security by Design."●Improving structural frameworks coordinated by the
Cybersecurity Strategy HQs for large scale IoT systems
security businesses.
●Establishing comprehensive guidelines for IoT systems
security in the energy, automotive, and medical industries,
etc.
●Implementing technological development and demonstrationin consideration of IoT systems characteristics and hardware
authenticity, etc.

Promotion of Enterprise Managementwith a Security Mindset●Building a framework for stakeholders, such as themarket, to evaluate appropriately enterprises' efforts
to address cybersecurity.
●Increasing the variety of layers of intermediators tofacilitate communication between senior executives
and cybersecurity professional.
●Expanding networks in the private sector and between
the public-private sectors to share information on
cyber threats and incidents.

Demonstration experiment of self-driving cars

Improvement of Cybersecurity Business Environment●Promoting cybersecurity-related businesses by using sovereign wealth funds, etc.
●Promoting effective security audit for the utilization of cloud services by SMEs, etc.
●Reexamining the existing mechanisms to promote cybersecurity-related businesses.
●Leading international discussions for establishing international standards and frameworks ofmutual recognition.
●Implementing measures to develop a fair business environment, such as advanced intellectual
property protection.

6 Cybersecurity Strategy

【 4. Policy Approaches towards Achieving the Objective 】

SPECIFICISSUE 2

Building a Safe and Secure
Society for the People"Development of cybersecurity infrastructure for 2020 and further"

Measures for the Protection of the People and Society●Promoting the gathering of information on vulnerabilities as well as the coordination and enhancement of thesystems for Internet monitoring and cyber attack detection.
●Promoting security measures for general users, such as security alerts and tips.
●Examining measures for security assurance for expanding public Wi-Fi spots, etc.
●Promoting local community-based outreach and awareness raising activities; awareness raisingand assistance for SMEs and local governments.
●Enhancing measures to advance cybercrime response and investigative capabilities.

Measures for Critical Information
Infrastructure (CII) Protection●Conducting constant review on the scope of CII and CII operators.
●Enhancing effective and prompt public-private information
sharing; promoting inter-governmental coordination andconducting training and exercises.
●For the smooth introduction and operation of the Social Security
and Tax Number System (My Number system), taking necessary
measures for local governments; enhancing monitoring andoversight mechanisms; and building a monitoring and detection
mechanism to supervise national and local systems as a whole.

Interactive outreach and awareness raising seminar(Cybersecurity Cafe)●Promoting internationally approved third-party certification
schemes for industrial control systems, such as smart meters.

Measures for the Protectionof Governmental Bodies●Enhancing security assurance through penetration tests;
addressing supply chain risks; improving detection andanalysis functions; and advancing defense capabilities
through defense-in-depth measures, etc.

Exercises to improve cyber incident response
capabilities (CII cross-sectoral exercises)●Achieving more resilient organizational mechanisms and response capabilities through management audit, risk
assessment, etc.
●Establishing and promoting inter-governmental common measures in view of the features of new IT products
and services.
●Comprehensively enhancing measures through monitoring, audit, and examination of incorporated administrative
agencies and special corporations performing public functions with the governmental bodies.
Cybersecurity Strategy 7

【 4. Policy Measures towards Achieving the Objective 】

SPECIFICISSUE 3

Ensuring Peace and Stability of
the International Community and National Security"Proactive contribution to peace in cyberspace"

Ensuring National Security●Enhancing response capabilities, both in quality and quantity, of relevant governmental bodies, suchas law enforcement agencies and the Self-Defense Forces (SDF).
●Ensuring cybersecurity to protect Japan's advanced technology (technologies related to outer space,nuclear energy, equipment of SDF, etc.)●Strengthening the public-private coordination in terms of information sharing, analysis, and response
for sustainable provision of services by the governmental bodies, CII operators, etc.

Building Peace and Stability of
the International Community●Contributing actively to the development of internationalrules and norms regarding cyberspace at the United
Nations and in other international settings.
●Cooperating with the international community to tackle
international terrorist organizations maliciously using
cyberspace.
●Promoting active cooperation for cybersecurity capacity
building of other countries.
Japan-ASEAN Cybersecurity Policy Meeting

Cooperation and Collaboration
with Countries around the World●Asia Pacific: Further strengthening and expanding
cooperative relationship with ASEAN, and enhancing
cooperation and partnerships with regional strategic
partners.
●North America: Enhancing close cooperation at every
level (Japan-U.S. Cyber Dialogue, Japan-U.S. Policy
Cooperation Dialogue on the Internet Economy, JapanU.S. Cyber Defense Policy Working Group, etc.)●Europe, Latin America and the Caribbean, Middle East
and Africa: Strengthening partnerships with countries
sharing common values with Japan.

8 Cybersecurity Strategy

Meridian Conference 2014 in Japan【 4. Policy Approaches towards Achieving the Objective 5. Promotion and Implementation of Cybersecurity 】

SPECIFICISSUE 4

Cross-Cutting Approaches to Cybersecurity

Advancement of Research andDevelopment (R&D)●Further advancing detection and defense capabilities
against cyber attacks by sharing information and data.
●Promoting interdisciplinary research on cybersecurity.
●Protecting cybersecurity core technologies for national
security.

Cybersecurity Camp for the youth●Enhancing R&D in international collaboration by
integrating unique technologies of different countries.

Development and Assurance ofCybersecurity Workforce●Developing multi-talented "hybrid" human resources.
●Promoting industry-academia-public collaboration
practical exercises in higher education.

and●Expanding elementary
cybersecurity.

for

and

secondaryeducation

Security contest with 58 countries (2014)●Developing a cloud environment for cyber exercises and supporting educational material development throughindustry-academia-public partnerships.
●Discovering and acquiring the best brains as global players by supporting international contest events, etc.
●Developing qualification schemes to evaluate practical skills and establishing the standards of basic skills, etc.

Promotion and Implementation of Cybersecurity●Strengthening detection, analysis, decision-making, and response functions through the further enhancement of
NISC's response capabilities and enhanced coordination and collaboration among industries, academia, andthe public sector, in addition to relevant governmental bodies.
●Develop close coordination and collaboration among the Cybersecurity Strategic Headquarters, the National
Security Council, and a headquarters for emergency response to terrorism, to respond to highly sophisticatedcyber attacks that might be state-sponsored.
●Towards the Tokyo 2020, clearly identifying risks; building and maintaining organizations, facilities, andcooperative relationships; and conducting comprehensive training.
The Cybersecurity HQs will formulate an annual plan and an annual report for each fiscal year, and establish abudget prioritization policy.
Cybersecurity Strategy 9

10 Cybersecurity Strategy

September 4, 2015
Cabinet Decision

Ⅱ. Cybersecurity Strategy（ Provisional Translation ）Cybersecurity Strategy 11

1

Introduction

Since the late 20th Century, the world has

malicious activities, how to best counterirreversibly

these threats is a challenge to ensure andexperienced

revolutionary
invention

maintain the free flow of information that is theof letterpress printing induced the explosion"backbone" of democracy, the safe and secureof knowledge, the invention of computers andliving environment of the people, economic andthe Internet, followed by their widespreadsocial prosperity, and peace, while protecting

use, has enabled people to discuss and share

intellectual properties that are the fruits of thethoughts

creativities and inspirations of individuals andtransformations.

As

Gutenberg's

throughout

the

world

geographic and time constraints.

without

Composedbusinesses as well.

of countless computers, sensors, and actuators

Under these circumstances, Japan enacted thethat have been networked by information andBasic Act on Cybersecurity in November 2014.

communications(hereinafter

This Act prescribes the concept of cybersecurity

referred to as "ICTs"), cyberspace has greatly

and defines the roles and responsibilities of

expanded the activities of people in physicalthespace. The free and interactive exchanges ofother relevant stakeholders; it also designates

ideas and opinions in cyberspace, originatedthe Cybersecurity Strategic Headquarters as

in digital messages and information sent fromthe command and control body of national

every part of the world, constitute the foundation

cybersecurity, and gives strong authorities,

of a global democratic society.

Additionally,such as making recommendations to national

sparking a cascade of new business models andadministrative organs, to the Cybersecurity

technological innovations, the digital space has

Strategic Headquarters. This mission document

become a frontier of economic growth.

is to be formulated pursuant to the Basic Act

In this new sphere of cyberspace, however,that prescribes the Government's responsibility

malicious activities are prevailing.

to establish the Cybersecurity Strategy.

technologies

Stealing

Government,

local

governments,andorganizational

Looking towards the Games of the XXXII

information and assets has been increasingly

Olympiad and the Tokyo 2020 Paralympic

persistent.

Games (hereinafter referred to as "Tokyo 2020")

personal,business,

andThere are also growing threats
security;

and the prospects further ahead for the early

governmental bodies and business operators,

2020s, this strategy outlines the basic directions

which provide mission-critical infrastructureof Japan's cybersecurity policies for the coming

necessary for the people's daily lives andthree years approximately.

economic activities, have been exposed to

articulates Japan's vision for cyberspace; and by

cyber attacks that would risk their business

implementing this strategy, Japan will endeavor

operations and continuity.

to ensure a free, fair, and secure cyberspace; andagainstnational

12 Cybersecurity Strategy

safetyandIn light of such

To the world, itsubsequently contribute to improving socioeconomic vitality and sustainable development,
building a society where people can live safe andsecure lives, and ensuring peace and stabilityof the international community and national
security.
To achieve this objective, the Government ofJapan has laid out this strategy as a platform
for the common understanding and actions of
relevant stakeholders.

Cybersecurity Strategy 13

2

2.1

Understanding on
Cyberspace
Benefits of Cyberspace"interconnected and converged informationsociety" where physical space and cyberspacehave become highly integrated. It is a society

Cyberspace is an artificial domain for the freethat enables the members of the society to

exchange of ideas without being constrained

create innovative services and to generate brandby national borders; it is an intangible frontier

new values exponentially.

of infinite values generated by intellectual

A free and fair cyberspace is a prerequisite forcreations and innovations inspired by the ideas

benefitting from cyberspace, which is an enabler

globally exchanged.

of the improvement of socio-economic vitality

The private sector-led

investment and the accumulation of wisdomand sustainable development.

have been pivotal to the rapid expansionof cyberspace; and, today, cyberspace is an
essential foundation of Japan's socio-economic
activities, as it has attracted a great deal of users

Increasing Threatsin Cyberspace

2.2

due to its non-discriminatory and non-exclusive
nature of easy accessibility.

While

On the other hand, the cyber "diastrophism"

benefits to our lives, malicious activities to harmprovoked by ICTs evolution is only in its

these benefits are increasing. Cyberspace, which

initial stage. Recently, all kinds of "things" oranyone can utilize without geographic and timephysical objects, from personal computers,

constraints, gives advantages asymmetricallyhome electric appliances, automobiles, toto malicious attackers, not defenders. At the

robots and smart meters, have begun to besame time, the increasing dependency of socio-

connected to networks including the Internet,

economic activities on cyberspace and thebenefitting from advanced hardware, such as

evolution of organized and highly sophisticatedsensor devices, the widespread of affordable

methods, or modus operandi, of cyber attacks

and high-speed Internet, and the advancementthat might be state-sponsored have causedof Big Data analytics technologies, and more.

grave damages and exerted negative impacts

Along with the increasing connectivity, physicalon the people's daily lives and socio-economic

objects and people in real space have become

activities, and consequently, threats againstinterconnected in a multi-layered manner

national security have become more serious

without physical constraints, by harnessing

year after year.

the free flow of information and accurate

Additionally,

data communications in cyberspace.

interconnected

Due tosuch linkages, there is an emergence of an
14 Cybersecurity Strategy

cyberspace

due
and

has

to

brought

thesignificant

arrivalconvergedof

theinformationsociety, malicious activities in cyberspace will

cause extensive impact on all kinds of connected
physical objects and services, and the damage
caused by cyber attacks will spread more
rapidly and widely in physical space; therefore,
it is anticipated that the people's living will be
exposed to more immense cyber threats in the
future.
To prevent further aggravation of such threats,
the creation of "free and fair cyberspace" must
be in parallel with the creation of "secure
cyberspace."

Cybersecurity Strategy 15

3

Visions and Objective

In accordance with the Basic Act on Cybersecurity,1Japan will make its maximum effort to ensure aand based on the understanding on the current

free, fair, and secure cyberspace as illustrated.

state described in the preceding chapter, Japan
has set the objective of this strategy as follows.

(2) Policy Areas the Strategy
Encompasses

Objective: Ensure a free, fair, and secure
cyberspace; and subsequently contributeto improving socio-economic vitality andsustainable development, building a society
where the people can live safe and secure
lives, and ensuring peace and stability of
the international community and national
security.

In

theinterconnectedandconverged

information society, activities in cyberspace
and those in the real world are closely linked.
Ensuring a free, fair, and secure cyberspace insuch a hybrid society will make it possible forindividuals in the real world to spend their daily
lives safely and affluently; for enterprises toengage in vital economic activities; and for the(1) The Cyberspace Japan Seeks

international community to maintain peace andFor the protection of the freedom of expression,

stability.

the creation of innovation, and the improvement

Japan is committed to ensure the rights andofissafety of the people, and to strive for therequired to be a space where freedom issocio-economic development of the nation

assuredas well as the development of internationalsocio-economic
without

vitality,

cyberspace

unnecessary

restrictions,and, in which all actors who wish to access areorder.

neither discriminated nor excluded without any

undergoing a historical paradigm shift in thelegitimate reason.

entire human society, the Government of JapanTo

preventthethe

has set the following three areas as its policy

international community as a whole fromgoals, that are: improving socio-economic

being threatened by information or property

vitality and sustainable development; building

theft and the disruption of the functions

a society where the people can live safe andof social systems posed by cyber attacks,

secure lives; and, ensuring peace and stability

cyberspace is required to become a secureof the international community and national

space with response capabilities against suchsecurity. The Government will implement thethreats, through the promotion of a better

Cybersecurity Strategy to reach these goals.

understanding on cyberspace among all actors,

Needless to say, Japan's economic growth, crisis

including individual people and organizations,management, and national security have relied

and through each actor's cooperative and self-

on the sound functions of socio-economic

motivated activities.

systems, and looming serious threats to these

16 Cybersecurity Strategy

people'slivingandStanding by these ideals, and whilesocio-economic systems are challenges to thehiddennation as a whole. It is a standing policy of thethis end, "investment" will be required toGovernment of Japan: to promote IT utilization,2 togenerate immense added values. Such active

assure the growth strategy firmly, and to take"investment" will enhance and sustain Japan's

all possible means to ensure national security,4

reliability in the international community forthrough cybersecurity assurance.

many years to come, and thus enable Japan to3behindits

convenience;

and

to

make progress towards a more affluent society.

(3) The Future of the Nation theStrategy Envisions
Targeting the early 2020s blueprinted in thisstrategy, Japan has ongoing projects to promote
the development of highly advanced social
infrastructure, such as autonomous systems
for self-driving cars and smart communities.
Regarding the Tokyo 2020, while there is a very
basic premise to take all possible measures toensure the security of various social systems
supporting the Tokyo 2020, it will surely offer
a great opportunity for Japan to showcase
its national excellence to the outside world.
Towards the coming future where ICTs areinterconnected with and embedded in physicalobjects and services, it should be reaffirmedthat Japan has unique advantages cultivatedover long periods of time, which have earned
global recognition as the "Japan brand," suchas the inventions of high-quality, technicallysuperior products and services that havesatisfied consumer confidence at home andabroad, and the safe and secured social systems
that have developed by organically integratingthese superior products and services.

What

Japan needs is a strategy to leverage thesenational advantages or the "Japan brand" for the
improvement of its national competitiveness.
To utilize cyber-physical integrated space,
it is essential to have capabilities for taking
appropriate actions against potential threats
Cybersecurity Strategy 17

1

The Basic Act on Cybersecurity (Act No. 104 of November
12, 2014), Article 1:“Facing domestic and foreign changes
such as the intensification of threats against cybersecurity
on a worldwide scale, and with the establishmentof the Internet and other advanced information andtelecommunications networks and the utilization of
information and telecommunications technologies, and given
the situation that it is an urgent issue to ensure the free flowof information and protect cybersecurity simultaneously, thepurpose of this Act is to comprehensively and effectively
promote cybersecurity policy by: stipulating basic
principles of national cybersecurity policy; clarifying the
responsibilities of the Government of Japan (hereinafterreferred to as the“Government”), local governments, andother concerned public parties; stipulating essential mattersfor cybersecurity-related policies such as cybersecurity
strategy formulation; and establishing the Cybersecurity
Strategic Headquarters and so forth, together with the
Basic Act on the Formation of an Advanced Information
and Telecommunications Network Society (Act. No. 144
of 2000), and as a result, attempting to enhance economic
and social vitality, sustainable development and realizing
social conditions where citizens can live with a senseof safety and security, and contributing to the protectionof international peace and security as well as national
security.”2

Declaration to be the World's Most Advanced IT Nation(established on June 14, 2013; revised on June 24, 2014)indicates:“Under the circumstances, as Japan strives
to become the world's highest level IT-based society,reinforcing cyber security will be imperative not only fornational security and crisis management, but also forbolstering Japan's industrial competitiveness through theuse of IT and data.”

3

National Revitalization Strategy (established on June 24,2014) indicates:“To ensure the Growth Strategy, the freeflow of information as well as the safety and reliability in IT
usage must be assured…”

4

National Security Strategy (established on December 17,2013) indicates:“ …cyberspace is necessary for promoting
both economic growth and innovation through the free flowof information in cyberspace. Protecting cyberspace… isvital to secure national security.”

18 Cybersecurity Strategy

4Basic Principles

Japan affirms the following basic principles
in policy planning and implementation for

4.2

The Rule of Law

reaching the objective of this strategy.
Intheinterconnectedandconverged

information society, the rule of law should be

Assurance of the Free Flowof Information

thoroughly applied to cyberspace in the same

The advancement of cyberspace as a hub of

as a secure and reliable space with equal accessinnovations and inspirations is relied on thefor everyone. In Japan, cyberspace is subject toassurance of the free flow of information inlaws and other rules and norms. Similarly, incyberspace. Japan considers that it is imperative

the view of Japan, international law and otherto create and ensure a cyber environment whereinternational rules and norms are applicable

the transmitted information will be neither

to cyberspace, and thus cyberspace should be

censored nor altered without any legitimate

governed by the rule of law in an international

reason, and will be delivered to intended

context as well.

recipients.

Furthermore, as cyberspace has continued to

In examining regulations in cyberspace, the free

expand and it has been utilized by diverse actors

flow of information must be fully respected,

all over the world, it is required to establish

and careful attention should be given to theinternational rules and norms in conformity

protection of individual privacy as well; in thiswith universal values, such as freedom andsense, due considerations should be made to

democracy, for peace and stability of themaintain the proper balance between necessaryinternational community. Japan will continue

regulations and the protection of privacy. As ato engage actively in the development andbasic condition for the free flow of information

implementation of international rules andin cyberspace, morality and common sense arenorms, and also act on the steady introduction

requested not to offend rights and interests ofof such rules and norms in every country based

others.

on its domestic situations.

4.1

way as it is applied in physical space. The rule oflaw is essential for cyberspace to be developed

Cybersecurity Strategy 19

4.5

Collaboration among
Multi-stakeholders

Japan affirms that cyberspace must not be

Cyberspaceisexclusively dominated by a certain group ofcomposed of various stakeholders’ activities

actors, but must be open to all people who wantin a variety of layers.

to utilize it; and that cyberspace connects ideas

it is necessary for the Government and all

and knowledge and brings new values into thecyberspace-related

world, with its openness and by maintaining

Criticalassured interoperability.

operators,

4.3

Openness

At the same time,amulti-dimensional

From this viewpoint,

stakeholders,Informationenterprises,

space

including

Infrastructure
and

(CII)

individuals,

toJapan is of the view that the majority of people’s

share a common vision of cybersecurity andaccess to cyberspace must not be denied for

fulfill

political gains of a certain small group.

and duties or make individuals’ efforts.

theirorganizational

responsibilities
The

Government bears a responsibility to foster
properly coordinated relationships among these

4.4

stakeholders.

Autonomy

In building such coordinatedrelationships, Japan is determined to takedynamic measures, by introducing interactive

During the past decades, the Internet has

and real-time information sharing and othermade progress powered by the autonomous

actions, taking into account current situational

governance of various participating actors.

factors, such as fast-growing sophisticated cyberEvenattacks.

if

cyber

threats

becomenational

challenges requiring the nation’s all-out efforts,
it is impractical, and inappropriate as well, for agovernment to take all charges for maintaining

On these principles of the strategy, any act oforder in cyberspace.

terrorism and other behaviors that threaten

With a view to achieving the coexistence of order

peace, and any act to support terrorism or suchand creativity in cyberspace, Japan respects self-

destructive behaviors, will not be tolerated withgovernance capabilities that the Internet has

respect to the freedom of people; instead, thesedeveloped, and regards every stakeholder’s self-

principles should be reflected in cybersecurity

reliant activities for the Internet management

policies in harmony with perspectives ofas the basic foundation of cyber governance,

people’s safety and security as well as national

thereby

andsecurity. In line with these five principles, andoperation of an autonomous mechanism forto protect the people’s safety, security, andthe fulfillment of the functions and missions ofrights, Japan reserves, as options, all viablevarious social systems connected to cyberspace,and effective measures, i.e. political, economic,

and for the deterrence of malicious cybertechnological, legal, diplomatic, and all otheractivities.

feasible means.

promoting

20 Cybersecurity Strategy

thedevelopment

Cybersecurity policies, asexpected by the people, should enable thecoexistence of the freedom of expression andthe protection of their privacy, while aiming
to protect their rights by deterring malicious
actors’ activities through the development ofrelevant regulatory mechanisms besides timely
and appropriate law enforcement.
Building the state of a world soundly governedby the rule of law – it is a way to stabilize theglobal market and inspire innovations; it also
contributes to national security as well as peace
and prosperity in the world, as malicious actors
are not tolerated in this kind of world.

Cybersecurity Strategy 21

Policy Approaches towards
Achieving the Objective

5

The following are the goals and directions of
the policies scheduled to be implemented in(3) Envisaging Cyber-Physical Space,
not Cyberspace Alone.

the coming three years, for delivering results of

All kinds of physical objects and people

the strategy. They are based on the five basic

have been interconnected by ICTs in a moreprinciples previously described and illustrated

multidimensional way, and the integration ofwith respect to each policy area where thephysical space and cyberspace has become morestrategy contributes. Each policy is expectedintertwined. Attention should be paid to the fact

to be consistent with the following threethat any event in cyberspace may affect society

approaches, to the maximum extent feasible.

as a whole, producing a synergy effect withvarious events including those in physical space.

(1) Being Proactive, not Reactive.

Recognizing

Perpetrators in cyberspace are always advancing

leading to the unprecedented interconnected

their methods of cyber attacks. Given the reality

and converged information society, Japan willthat cyberspace has vulnerabilities inherent

implement policies by precisely capturing suchto itself because of its digital-based structure,social transformation.

Japan will not wait until some damage would
be done; instead, Japan will take necessary
measures proactively, by conducting analyses
on future social changes and potential risks.

(2) Acting as a Catalyst, not Just a
Passive Player.
For achieving the goal set in (1), withrecognition that cyberspace is a space built
and operated by actors of the private sector as
the main driving forces, Japan will implement
policies

tocatalyze

theirself-motivatedactivities and their own initiatives.

At thesame time, Japan will undertake a leading role
as a responsible member of the international
community and proactively contribute to peaceand stability in cyberspace that is global by
nature.

22 Cybersecurity Strategy

thetransformational

process

5.1

Improving Socio-Economic Vitality
and Sustainable Development

serious social and economic impacts. Such risks
would harm the reliability and quality of the
IoT-based services. It suggests a new challenge

In the emerging interconnected and converged

to tomorrow's society at large, that is, how to

information society, all kinds of physicalminimize cybersecurity risks at an acceptableobjects, from personal computers, home electriclevel, in counterbalance with the merits of theappliances and automobiles, to robots and smart

services provided with the IoT systems.

meters, are connected to networks including theIn

Internet.

This interconnectivity will lead theinformation society, for enterprises in Japanemergence of transformative systems (Internet

to lead the national economy by realizingof Things systems; hereinafter referred to as

the creation of new business and adapting"IoT systems") capable of bringing new services

current businesses to the more sophisticatedby using Big Data generated in such networks,

environment, and to bring about the largest

and so on. As the IoT systems will prevail, thebenefits of the society of this kind, it is required

integration of cyberspace and physical space

to take measures proactively in industry-

will become more advanced and intensive.

academia-public partnerships to address the

It is foreseen that enterprises will shift theirabove-mentioned challenge.

efforts to create new business by utilizing thethe demands of the current digital age to

IoT systems and adapt existing businesses toachieve higher level security than ever before

this more sophisticated environment. For theas a quality feature of services by using Japan's

improvement of Japan's socio-economic vitality

advantages developed over years, including theand sustainable development, it is highly

provision of high-quality services, the enterprise

important that enterprises in Japan will not failmanagement to build stakeholder confidence,

to seize these new business opportunities.

and the creation of a fair market environment

When enterprises provide new services throughsupportive for such business practices.

the IoT systems, ensuring "security as a qualityof these efforts to meet the new demands

feature" is a prerequisite. It means that safety

will become a source of corporate values andand security are pre-installed as essential

international competitiveness.

service quality features, which is expected

In this line of thought, with regard to theby individual customers and business users

IoT systems for realizing new services in thein the market. Suppose a physical object wasinterconnected

remotely controlled by cyber attacks to makesociety, enterprise management, and business

unplanned movements; personal data wasenvironment

stolen via a wearable device; or, several millions

Government will take the following strategic

or tens of millions cases of personal and otherapproaches.

theinterconnected

and

and

Likewise, it isconverged

supportive

converged

for

All

information
them,

the

information were compromised due to a single
cyber attack targeting a database involving
various stakeholders, which resulted in causing
Cybersecurity Strategy 23

5.1.1 Creation of Secured IoT Systems(2) Improving Structural Frameworks
for IoT Systems Security

Given the prospect for the massive use of the

For the improvement of socio-economic vitality

IoT systems during the Tokyo 2020, the successand sustainable development, it is crucial toof this world event will not be achieved without

stimulate business innovation in IoT systems-

industry-academia-public

torelated large scale business with the pertinent

make up-front investments in the assurance ofcross-cutting coordination among stakeholders

high level security as a quality future in the IoTof industries, academia, and the public sector.

systems. Without such a joint effort, it is also

In this course, such business should be

difficult for enterprise in Japan to create newpromoted in the Security by Design approach.

business and new employment opportunities

To make it possible for relevant stakeholders

by utilizing the IoT systems.

to collaborate based on mutual confidence andAiming at creating the secured IoT systems

each stakeholder's self-motivated activities, it iscapable of meeting market needs by 2020,

necessary to build a common understanding on

and subsequently enhancing the international

relevant matters regarding security measures

reputations

required for the business concerned, e.g. theofJapan'scollaboration

IoT

systems,theGovernment will make efforts as follows.

goals, means, and durations, and to clarify thetasks of relevant stakeholders on that basis.

(1) Promoting New Business
Harnessing Secured IoT Systems

For example,

thedevelopmentof highly

trusted Intelligent Transport Systems (ITS)

For an IoT systems-related new business toconcerns

become successful, it is imperative to achieve

academia, and the public sector, including

high level security as a quality feature, which isrelevant governmental bodies, enterprises, andthe base of competitiveness. The IoT systems

research institutes. It is expected that: thesewill not become intrinsically secured, however,stakeholders first develop objective insights

just by retrofitting security, which would rather

on both of the coexisting advantages and risks,cause a large increase in cost. In this context,

which would be brought by the adoption of ITS;

the Government will promote the idea of

second, they build a common understanding on"Security by Design," an approach to incorporate

related factors, e.g. required security measures,the assurance of security into the initial phase

their implementation methods, and durations;of the planning and design of the entirethen, based on these recognitions, they decide

IoT systems including the existing systems

each stakeholder's tasks clearly. In this way,connected to them. More specifically, as to IoT

they can accelerate their collaborations based

systems-related business, the Government willon mutual confidence and each stakeholder'spromote security measures for these systems in

self-motivated activities, and it will result ina cross-sectoral manner, based on the Security

effective and high value-added business.

by Design approach, and will give its prioritized

In this view, among the government-led

support to the growth of such new business.

IoT systems-related large scale businesses,

24 Cybersecurity Strategy

multi-stakeholdersofindustries,those possibly having substantial impacts onother relevant industries.

socio-economic activities will be handled by

Meanwhile, it is impracticable to provide

theCybersecurity

Strategic

Headquarters.

the secured IoT systems, unless necessary

The

Cybersecurity

Strategic

Headquarters

measures are taken, e.g. releasing and installing

will promote the consistent and exhaustive

security patches or software updates, by quickly

implementation

pinpointing technical problems developingofrequiredmeasuresforthem, by implementing program planning,in cyberspace.

policy formulation, and overall coordination

measures for relevant parties to make concerted

requiredcybersecurity

efforts to: examine the vulnerabilities of themeasures, facilitating organized and converged

IoT systems and devices comprising the IoT

coordination among relevant governmental

systems; encourage the suppliers of the IoT

bodies and entities, and by other appropriate

systems and devices to take necessary actions toways.

modify detected vulnerabilities; and elaborate toforcross-cutting

The Government will seek

create specific means to inform users of the IoT(3) Considering Approaches for

systems and devices about safeguard measures

Enhanced IoT Systems Security

to fix the detected vulnerabilities.

Similarly,

For the timely introduction of the IoT systems,

the Government will promote relevant parties'

which are assured with a high level security as acollaboration to: synthesize and analyze themarket-expected quality feature, in the market,

data on security quality and threats detected

appropriate security measures must be takenin the use-phase of the IoT systems; feedbackin the whole supply chain of the IoT systems.

the results of the synthesis and analysis toThis means that stakeholders will need a policy

stakeholders, such as IoT systems developers;

platform to build a common understanding

and realize and provide more secured andon security measures required for the entire

higher-quality services.

IoT systems as well as for the individualcomponents of the IoT systems. In addition,(4) Implementing Technologicalthey can challenge new business opportunities

Development and Demonstration

more easily, if there are safety guidelines and/or

Related to IoT Systems Security

reliability indices, including those from security

For the promotion of new business creation

perspectives,

progressively

utilizing the IoT systems, it is necessary to

introducing the IoT systems into the market.

advance technological development and otherFor these reasons, the Government will, inmeasures to assure security, by addressing

collaboration with industries and academia,

risks associated with the procurement andestablish

andintroduction of unreliable and low-end devices,

standards for IoT systems security, including thebased on the understanding that IoT systemcomponents of the IoT systems, such as M2Mcomponents have the characteristics different(Machine to Machine) devices and wearablefrom those of conventional information anddevices, in the energy, automotive, medical, andcommunications devices, for example, in terms

asrequired

comprehensiveinguidelines

Cybersecurity Strategy 25

of longer life cycle from design to disposition

to promote the enterprise management with aand limited throughput capacity.

security mindset at enterprises in Japan.

From thisstandpoint, the Government will work on thedevelopment and demonstration of ICTs in(1) Changing the Thinking of Senior
Executive Management

which such characteristics of the IoT systemcomponents are incorporated.

It is indispensable for enterprise management

Besides, it is crucial to take security assurance

that senior executives utilize their business-measures for the entire IoT systems, for thecriticalpurpose of providing services with immense

recognition of their strategic values and roles.

added values by using the systems composed

In bringing products and services in which highof a variety of networked physical objects. The

level security is assured as a quality feature

Government will work on the development andto the market, and in making management

demonstration necessary for the examination

decisionsof IoT system-related security measures andcybersecurity knowledge has become a basic

others, such as the development of a systemcompetency required for enterprise senior

testing

executives.

environment,themethodologicalsystems

for

and

trade

new

secrets,businesswithcreation,

For the enhancement of Japan's

development of risk analysis and evaluation onsocio-economic vitality as well as sustainable

the entire systems, the confirmation methods ofdevelopment,

the authenticity of hardware including IC chips,

enterprise senior executives will grasp suchand social sciences research as well.

societal changes precisely, and raise awarenessitisnecessary

that

more

of cybersecurity measures not as an inevitable

Promotion of Enterprise Management
5.1.2
with a Security Mindset"cost" of business but as an "investment" formore progressive management. To this end, theGovernment will build: a guiding framework

Enterprise management in the interconnectedthat enables stakeholders, such as the market

and converged information society requires, inand investors, to evaluate properly enterprises'

addition to the existing cybersecurity measures,

efforts to address cybersecurity as a criticalmore comprehensive and enhanced actions for

management

the creation of new business and other businessthat

activities, in terms of the monitoring anda fundraising aspect, to enterprises making

assessment of security risks and appropriate

such efforts.

investment

implement

decisionsonmanagement

gives

challenge;
financial

andaframework

advantages,

includingSimilarly, the Government will
collaborativeawarenessraisingresources, the promotion of the adoption ofactivities with the private sector to cultivate

security functions in products and services,

enterprise senior executives' understanding on

cybersecurity human resources development,

cybersecurity.

the improvement of organizational cybersecurity

Meanwhile, to incorporate cybersecurity in theircapabilities, and others.

business strategies, it is necessary for enterprises

For this reason, the following will be undertaken

to assign a chief cybersecurity executive at the

26 Cybersecurity Strategy

board level. To this end, the public and private(3) Strengthening Organizational
Capabilities

sectors will work together, aiming that Chief
Information Security Officer (CISO)'s functions

In

the

interconnectedandconverged

will be adequately positioned at the senior

information society, installing assured security

executive management level of each enterprise.

in products and services will enhance enterprisecompetitiveness and will lay the foundations(2) Fostering Cybersecurity Workforce

for the continuity and progress of enterprisefor Advanced Business Management

activities. In this context, the Government will

To leverage cybersecurity perspectives andseek to increase understanding of the value

capabilities

management,of the "Security by Design" approach among

it is necessary for both senior executive

relevant actors working on products and services.

management and cybersecurity professionals

From the viewpoint of the protection of trade

to share their corporate management strategy

secret and business continuity, the Government

and the directions of cybersecurity challenges

will promote and disseminate informationand solutions. The Government is planning toabout effective business management, e.g. theincrease the variety of layers of intermediators,

promotion of organizational management based

who are capable of: understanding management

on risk analysis, and will work on necessary

policies

actions to enhance cybersecurity throughout

indecidedenterprisebyseniorexecutive

management; presenting cybersecurity visions;the inter-organizational supply chain.

and facilitating communication between senior

Moreover, with regard to the improvement

executiveof response capabilities against cybersecurity

management

andcybersecurity

professionals.
As

incidents, such as cyber attacks that would

cybersecurity

becomepose serious business risks to enterprises,management

it is encouraged that enterprises will adopt

and business strategies, there are increasingnecessary measures, such as creating andorganizational needs for enterprises to develop

operating a CSIRT (Computer Security Incident

cybersecurity talent as their in-house workforce.

Response Team) with liaison functions for

To respond to such needs, the Government will

incident detection and response; developing

examine long term human resources strategies

plans and tools for rapid response to andand performance appraisal methods, taking

recovery

into consideration cybersecurity-related career

conducting cyber exercises; and improving

paths, in other words, those for cybersecurity

corporate

professionals, intermediators, senior executives

effective public communications. Noting the

responsible for enterprise risk management

effectiveness of such measures, the Government

including cybersecurity risk management, andwill promote enterprises' efforts for the aimed

others, and will encourage senior executive

improvement in word and deed.

management

In addition, the Government will provide its

indispensableintomeasuresenterprise

adopt

such

workforce development policies.

havecybersecurity

fromcybersecurity

businessfunctions

incidents;
for

more

support and advice to enterprises by creating
Cybersecurity Strategy 27

the
on

guidelines

of

and

other

cybersecurity-related

information

cybersecurity-related businesses to become amanagement,

growth industry; and a fair market environment

including the improvement of organizational

in Japan as a basis of every business.

cybersecurity mechanisms under the leadership

Government will implement the followingof senior executive management, effective

measures, aiming at the improvement of businessmeasures based on the latest trends in cyberenvironment where assured cybersecurity andattacks, damages, and others, and information

enhanceddisclosure policies; the Government will also

enterprises in Japan can be based.

internationalThe

competitivenessofwork to establish a framework for objective
evaluationofenterprises'

activities

taken

on the basis of such support and advice by(1) Promoting Cybersecurity-related
Businesses

using certain evaluation methods, such as

Along with the growing IoT industry andthird party certification.

As for information

associated businesses, it is anticipated that thesharing, including information on measure-demand for cybersecurity-related businesses,

related challenges, best practices, and theincluding consulting and human resources

latest trends in cyber threats and incidents,

development business, will be further increased

the Government will support the further

in the future.

advancement and expansion of information

the development of cybersecurity businesses,

sharing networks in the private sector andfor example, by fostering enterprises having abetween the public-private sectors, including

potential for a large scale business at home andplatform building for information sharing byabroad and business ventures, and so on, so that

actively utilizing incorporated administrative

they could meet the increasing demand andagencies with cybersecurity-related knowledge

become a growth industry as a whole.

and experiences, as well as organizations andInitially,other entities with incident information sharing

networks to collect cyber-related information

and analysis functions, e.g. ISACs (Informationand for the promotion of intelligent business

Sharing and Analysis Centers).

with data analysis and information service

for

The Government will support

thedevelopmentof

globalcapabilities in this regard, the Government will

Improvement of Cybersecurity
5.1.3
Business Environment

work to establish leading projects of Japan's
cybersecurity-related

businesses,

bytakingmeasures, such as extensive and intensive

For Japan's IoT Industry and other ICTs-based

investment

digital businesses to become internationally(SWFs) in the cybersecurity field.

competitive and subsequently become the

Meanwhile, given that the utilization of secured

engines of the national economy, and forcloud services is considered to be effective

Japan to build capacities for the self-reliant

for small and medium sized enterprises andassurance of cybersecurity, it is required toother entities having a difficulty in building

develop: a domestic environment necessary forsufficient security environments by their own

5

28 Cybersecurity Strategy

using

sovereign

wealthfunds

efforts, the Government will promote the wide

activities; and practical training and exercises.

implementation of relevant measures, including

Meanwhile, the Government will take a strict

security audit regarding cloud services.

action against any reprehensible conduct using

Additionally, in the cybersecurity field that

security as an excuse or a reason to produce

requires high maneuverability to address its

negative effects on international trade rules andconstant diversification, it is critical to vitalize

agreements.

business ventures and other enterprises striving
for innovative new business and technological(3) Improving Environment for Japanesedevelopment. For this reason, the Government

Enterprises' Global Operations

will utilize SWFs to undertake activities in the

For Japan's Internet of Things industry andcybersecurity field, such as: the promotion of

cybersecurity-related businesses to become

collaborative research and development (R&D)

internationally competitive and subsequently

among domestic and foreign business ventures,

lead the national economy as a growth industry,including international exchange programs; theJapan's policy perspectives in this regard

promotion of collaborative R&D between publicmust be fully incorporated in international

research institutes and business ventures; andframeworks, including international rules andthe development of business ventures by taking

norms.

advantages of such R&D achievements.

and academia, the Government will act as a

Furthermore, to promote cybersecurity-related

global leader in international discussions forbusinesses, it is necessary to undertake theestablishing the international frameworks ofreview of the existing mechanisms flexibly. The

mutualGovernment will work on necessary reviews,

the international security standards as well as

including the clarification of the applicability

the evaluation and certification mechanismsof the copyright law to reverse engineering6of the IoT systems, including control units;

for security purposes and the reexamination of

the Government will also work on informationnecessary mechanisms.

sharing and the transfer of Japan's best practices

Working in tandem with industries

recognition

arrangement

regardingin international settings.

(2) Developing Fair Business Environment

For the international operations of Japan's IoT

For building economic systems that always spurindustry and cybersecurity-related businesses,

innovation and produce corporate profits, it is

it is essential to assure security in social

essential to protect the values of technologicalinfrastructure abroad, such as the security

information,enterprises'

coreof data produced and circulated in the IoTtechnologies and production expertise.

Thesystems.

Government

includingwill

implement

From this standpoint of view, thenecessary

Government will support the development of

measures, including: legislative measures tonecessary mechanisms for cybersecurity as

safeguard

property

well as outreach and awareness activities inmore firmly and to enhance the measures taken

the Association of Southeast Asian Nationsin the case of violations; awareness raising(ASEAN) and other countries that have strong

enterprises'

intellectual

Cybersecurity Strategy 29

economic ties with Japan.
Inaddition,

so-called"supply

chain

risk7

5.2

management" has become critical, as the

Building a Safe and Secure
Society for the Peopleinternational operations of Japanese enterprises

In recent years, there have been a growing

have expanded in recent years. Taking it into

number of incidents seriously threatening theconsideration, the Government will promote

people's living, particularly, the security ofsupply chain risk management, for example, by

individual personal information and properties;

promoting necessary R&D as well as bilateraland associated damages have become more

and regional cooperation with ASEAN and othergrave and widespread. Under the circumstances

countries.

in which the cyberspace environment will befurther drastically evolving with the expanding
IoT systems, the launch of the Social Security
and Tax Number System (the My Number
system) operation, and so on, a safe and securesociety for the people cannot be built, unlessmulti-layered

cybersecurityisassuredbyrelevant multi-stakeholders, from governmental
entities, local governments, and cyber-related
business operators, to private enterprises andeach individual citizen.
The functions and services of CII and those of
the governmental bodies are the mission-criticalinfrastructure for the people's living and socioeconomic activities. Since it is highly likely that
any interruption of these functions and services
will cause direct and significant consequences
to the people's safety and security, it is crucial
to take all possible measures to address andprevent such events.

It is necessary to takeapproaches based on "mission assurance" inwhich mission owners should analyze risks
and should have discussions with asset owners
from the viewpoint to accomplish the functions
and services of CII or the governmental bodies.
Mission owners should ask comprehensive
decisionsofinformation
resultant risks.
30 Cybersecurity Strategy

senioron

executives,

providingvulnerabilities

includingWhile Japan will certainly draw the world's

in cyberspace.

attention towards major international events,
including the Tokyo 2020, it is anticipated that

(1) Building a Safe and Secure Cyber
Environment for Users

these events will also attract malicious actors'
attention for cyber attacks and other cyber-

Private enterprises, including digital device

related threats. As a matter of national prestige,

manufacturers,

Japan is determined to make concentrated

network management business operators, andefforts to address cybersecurity concerns, insoftware developers, are the major providers ofclose coordination among relevant stakeholders.

the components of cyberspace, such as devices,

Furthermore, Japan will maintain and advancenetworks, and applications. Similarly, tools toknowledge, skills, and experiences to be gained

combat cyber risks are also provided mainly by

from these future occasions, as precious national

the private sector.

assets that will be meaningfully utilized for the

Besides

people's safety and security.

cybersecurity-related business operators are

In this view, aiming at responding to cyber

encouraged to take the Security by Design

threats and subsequently building a society

approachwhere the people can live safe and secure lives,

embedded into the initial phase of system

the Government will implement the following

planning

measures.

explanation about this embedded securityaInternet

pursuit

by
and

for

which

serviceconvenience,

security

design,providers,

and

these

assurance
giveisadequatefeature to their customers, while being aware of

5.2.1

Measures for the Protection of
the People and Society

their responsibility to eliminate vulnerabilities
in all of their services and products.

They

are also encouraged to make their efforts, infromclose coordination with the Government andcyber threats requires the secured and stablerelevant governmental entities, to improve

provision of devices and services comprising

cyber attack-related incident detection andcyberspace, as the essence of a safe environment

analysis functions, and take necessary actions,for cyberspace users.

such as issuing security alerts and tips for their

Protecting

thepeopleandsociety

It also requires self-

motivated efforts of cyberspace users, including

customers and general users.

individuals, enterprises, and organizations, toTherefore,raise their cybersecurity awareness and literacy,

information gathering regarding vulnerabilities,

and take cybersecurity measures voluntarily.

e.g.

Additionally, for inhibiting malicious behaviors

coordination and enhancement of the systems

and other threats in cyberspace, it is crucial

to monitor the Internet and detect cyber attacks

to enhance necessary measures proactively

and other cyber events.

to track incidents and prevent the recurrence

In order to protect the users of cyberspace fromof the incidents, together with preventive

cyber risks which require urgent attention,measures against potential crimes and threatssuch as a possible exploitation of a vulnerable

thesoftwareGovernment

will

vulnerabilities;

promote:andthe

Cybersecurity Strategy 31

device for being used as a springboard of ayouth, more specifically those who are justcyber attack, and to build a safe and beneficial

about to become the users of cyberspace, along

Internet environment, the Government willwith their parents or guardians.

elaborate necessary measures to prevent aefforts will be made to promote tailoreddamage possibly induced by malware infection,awareness raising activities for those who do notin addition to provide security alerts and tips forbelong to any organizations, such as a school or

the user(s) of a compromised device.

a company, for they often do not have enoughMoreover, there are ongoing efforts towards

opportunity to learn about cyber threats and2020 to improve Internet communications

cybersecurity measures. The Government will

environments

comingalso continue to promote human resources

to Japan, e.g. expanding public Wi-Fi spots.

development policies to foster cybersecurity

Under the circumstances, the Government

experts who are capable of answering Internet

will reexamine necessary measures from theusers' questions and concerns, and the activities

viewpoints of cybersecurity as well as user-of these cybersecurity experts as well.

friendliness.

In

for

foreignvisitors

additiontoAdditional

comprehensive

publicawareness raising activities implemented by(2) Promoting Security Measures

the Government and relevant entities, it isTaken by Users of Cyberspaceencouraged to revitalize local community-based

Regarding the Internet use with personal

outreach and awareness raising activities, forcomputers, smartphones, and other devices, onsuch activities are suitable to take multifaceted

the one hand, public awareness and knowledge

approaches to meet the diverse needs of theof cybersecurity has hardly reached a sufficientpeople who have different backgrounds inlevel; there is another concern, on the otherterms of age groups, occupations, life styles,

hand,

and others.

in

the

current

environment

where

The Government's actions will

cyber risks have become more complex andinclude strong support for grass-roots local

diversified, that Internet users with insufficient

activities that enable the promotion of outreachcybersecurity

becomeand awareness raising activities at the local levelvictims and would end up becoming offenders

in collaboration among multi-stakeholders of

unknowingly.

industries, academia, and the public and private

To address such concerns, and to support thesectors.

self-help efforts of the public or Internet users,

For the assurance of the people's security

the Government will promote outreach andand safety, it is critical to raise awareness notawareness raising activities in coordination with

only for individuals but also for organizations

relevant stakeholders, such as the "Cybersecurity

and entities, such as private enterprises or

Awarenessorganizations engaging in a wide variety

awareness

Month"

andwould

awarenessraisingof appropriate actions against malware andofsuspicious emails. Particularly, the Government

responsible for administrative services directlyis planning awareness raising activities for the

related to local residents, and public entities

32 Cybersecurity Strategy

economic

activities,

local

governments

including educational organizations handlingin accordance with laws and statutes, and behuge volumes of personal information ofready to handle new methods of cybercrimes

students, school children, and their parents orthat would likely emerge in the near future.

guardians.

Especially, for organizations and

For these reasons, the Government will promote

entities which have difficulties to take necessary

the improvement of structural arrangements

cybersecurity measures by themselves, suchfor: the enhancement of information gathering

as small enterprises and small local public

to obtain a better understanding of cyberentities,

promotethreats; the advancement of cybercrime-relatednecessary measures, taking into consideration

investigative capabilities; cybercrime control,that it requires the coordinated efforts of theinternational coordination, and more.

stakeholders

addition, since advanced technical knowledge

theGovernment

of

the

will

Government,

relevantIn

entities, industrial organizations, and others, toandsupport awareness raising measures, including

cybercrime

the organization of seminars, the formulationof damage and the spread of damage, theandcybersecurity-related

Government will promote the accumulation ofguidelines, the improvement of the structures

technical know-how, technologies, and otherto share cybersecurity information concerning

skills necessary to this end, by improving thethe latest methods of cyber attacks and otherstructural arrangements for digital forensics,

relevant matters, and the implementation ofsuch as the technological advancement fortraining and exercises.

malware analysis and others as well as thedisseminationofskillsareessential

control,

toandinvestigation,

theprevention

sophistication of the systems to monitor the(3) Enhancing Measures against
Cybercrimes

Internet and detect cyber attacks and othercyber events.

Likewise, the Government

Along with the increased interconnectivity ofwill promote human resources development

cyberspace and physical space, the number

andof cybersecurity incidents closely related toFurthermore, for the purposes of cybercrime

individuals and enterprises – such as illegal

investigation and prevention, the Government

money transfers by exploiting Internet banking,will aim at the active use of knowledge andstealing information by targeted attacks, andexperiences of the private sector and thephishing – has drastically grown. There is alsoenhanced public-private partnerships including

a rise in the number of breaches of personal

personnel exchange programs between theor confidential information, including a large-

public and private sectors.

scale personal data breach; as a result, suchSince

repeated cybercrimes have become serious

enterprises is indispensable for the assurancesocial concerns. Without advanced cybercrimeof cybercrime traceability, the Government will

response and investigative capabilities, it istake measures necessary to make progress in thisdifficult to capture the reality of malicious

area. Especially with regard to the management

cybercrimes, control cybercrimes appropriatelyof stored log data, the Government willtechnologicalcooperation

developmentfromsoundly.

cyber-related

Cybersecurity Strategy 33

encourage relevant private enterprises to takethe implementation of training and exercises,

appropriate actions based on the revision of theand the improvement of information sharing"Guidelines for Personal Information Protection

arrangement between the public and private

in Telecommunications Business."8

sectors.
HavingMeasures for Critical Information
5.2.2
Infrastructure Protection

achieved

substantial

results

inprotecting Japan's CII, these existing measures
will be implemented as they have been.
Meanwhile, these measures would easily lose

Various kinds of social infrastructures havetheir effectiveness and become obsolete without

ensured the people's living and economic

any modification to match the needs of theactivities, and a wide range of information

constantly diversified social and technologicalsystems has been used for the functions of theseenvironments related to CII. The Governmentsocial infrastructures. In the circumstances, thewill make efforts to regularly reexamine thepublic and private sectors must work together

existing measures and activities as indicatedto protect CII, in particular, information andin the following sections, and elaborate andcommunications

power

promote the specific approaches, including the

supply services, and financial services, of whichfurther enhancement of cybersecurity, of thesethe functional failure or deterioration would

measures. Meanwhile, CII operators and theirrisk enormous impacts to the people's living

competent ministries have conducted criticalconditions and economic activities. Such task

information infrastructure protection (CIIP)

cannot be entirely designated to the Government

against cyber attacks by setting the safety

as a sole stakeholder, leaving the private sector

standards, including mandatory standards andwith no responsibility, or vice versa; rather, it

guidelines; to this extent, with regard to CII

calls for strong public-private partnerships.

sectors having the original standards of service

As CII is required by its nature to provide amaintenance and safety assurance stipulated bycontinuous supply of service, for its protection,a specific law regulating a certain industry, theit is crucial to reduce the occurrence of system

Government will carry out a constant review of

failures caused by cyber attacks or other reasons

the safety standards, taking account of current

to the minimum extent; it is also crucial to carryenvironmental changes in cyberspace.

services,

electricout early detection of any system failure andprompt recovery from damage or failure.
The Government established the third edition(1) Conducting Constant Review on the
Scope of CIIPof the "Basic Policy of Critical Information

Due to social environmental changes, theInfrastructure Protection"9 and identified criticalaccumulated relevant knowledge and experiences,

information infrastructure sectors.10 Based on

and more, it has become necessary to include athis CII policy, the Government has promoted

certain sector, which is not currently identified

various measures, including the enhancement

as a CII sector, in the CII sectors, as the impact ofof safety standards and awareness raising,the information system failure of the said sector is

34 Cybersecurity Strategy

assumed to be serious. For this, the Government

information sharing arrangements, whether orwill conduct a constant review on CII itself. It

not these enterprises fall in the definition of CII.

should be noted that it is not necessary for a newly
added CII sector to implement exactly the same
CIIP measures as other incumbent CII sectors have(2) Ensuring Effective and Prompt
Information Sharing

done; because of an increasing number of the CII

As cyber attacks have become more complex

sectors, it may become difficult, too, to implement

and sophisticated, in order to counter diversified

common measures across the CII sectors. Fromcyber threats appropriately, the public andthese standpoints, the Government will takeprivate sectors must closely collaborate innecessary actions, including the classification of

sharing information on system failures possibly

the CII sectors, based on the characteristics of eachcaused by cyber attacks. To make information

sector, such as the degree of interdependence

sharing more active, it is essential to relieve CII

with other sector(s), the services it has provided,

operators' psychological burden of potentiallyand any law concerning that sector.

losing the credit or ruining the reputation of

Meanwhile, as for the current CII sectors, fortheir businesses if providing information to amore reliable and secured service provision, it

relevant party, and enable them to recognize

is essential to assure "cross-cutting sector-wide

the advantages of such action instead.

protection," rather than "pinpoint protection"

Government will encourage CII operators towith each CII operator's limited effort. In thiscreate a common understanding on making

sense, the Government will conduct a review

appropriate modifications of information to

on the scope of "CII operators" regularly. For

be provided, such as concealing informers'

example, the measures exclusively applied to theidentities and specifying the scope and limit

major operators would be expansively appliedof information to be shared, and will create an

to small and medium sized enterprises; or, theyenvironment where informers will not suffer

would be more inclusively applied to peripheral

any unreasonable loss or disadvantage frombusinesses, too, such as relevant outsourcing

providing information. As for those handling thecontractors and major affiliated businesses thatprovided information, they are required to haveare indirectly related to the services provided byadequate information analysis capabilities; andthe CII operators.

issue security warnings and alerts in a timely

In addition, consideration should be madeand appropriate manner based on the provided

to provide protection for private enterprises

information.

outside the CII sectors, since CII is not the single

create an interactive and advanced information

target of cyber attacks. With regard to Japan's

sharing

leading enterprises and those critical to national

platforms as a basis of collecting, analyzing,security,

including those requiring certain

and sharing provided information so that CII

measures, such as a physical protection measure

operators can properly obtain informationof nuclear materials, the Government will further

necessary for CIIP from cyber attacks.

consider necessary actions, such as enhancing

In view of the year 2020, more effective and faster

The

The Government will strive toenvironment,

includingbuilding

Cybersecurity Strategy 35

information sharing is required in building a

to prevent the damage from becoming more

world-class defense framework against cyberserious.

attacks. Given that it is effective to collect not

For the purpose of ensuring the effectiveness

only information on system failures at or aboveofa certain level, which are subjected to reporting

conduct cross-sectoral training and exercisesby a specific law regulating a certain industry

for stakeholders of the public and private

and/or other regulations, but also information

sectors, and will continue to make necessary

on minor system failures as well as those

improvements.

thesemeasures,theGovernment

will

showing the signs of cyber attacks or predicting
cyber attacks, the Government has made(3) Offering Tailored Support to CII Sectors

efforts to collect such information, based on a

As for local governments, their responsibility

consensus among relevant stakeholders; in theand the cooperative measures taken by thecircumstances, the National center of Incident

Cybersecurity

readiness

Cybersecurity

support them are prescribed under the Basicministriesof

Act on Cybersecurity. All local governments,

CII operators will work in tandem moreregardless of their scales, have a uniqueclosely and engage in information gathering

status, as they are required to meet theproactively.

security(NISC)

andand

Strategy

theforcompetent

The Government will also work

Strategic

standards

Headquarters

similarly

to

those

to

of

to strengthen necessary coordination among

the governmental bodies and government-

relevant governmental entities, particularly torelated entities, because of their functions,accumulate critical information at the NISC fore.g. handling sensitive information.

the purpose of building a structure for prompt

an environmental transition expected in local

information sharing with necessary measures,

governments, for they will need to adopt newsuch as building a hotline between the NISC

systems due to the nationwide introduction of

andinformation

the My Number system. The Government will

sharing methods and procedures, and adopting

provide necessary assistance, in accordance

automatic information processing.

with the Basic Act on Cybersecurity, for their

When a CII operator reports a cyber attack tosecurity assurance, and will examine and takerelevant governmental bodies responsible fornecessary measures regarding the information

incident response, the governmental bodies

systems of local governments, with the object ofwill work, as a coordinated effort, on situational

strengthening cybersecurity for the operation ofawareness to obtain an accurate understanding

the My Number system.

of what is happening, while helping the CII

At the same time, the Government will take

operator(s) manage the critical situation. The

necessary

Government will extensively share obtainedoninformation on the occurred incident, including

including

attackers' methods, with the governmental

and improved operational frameworks build

bodies, CII operators, and other relevant parties,

upon advanced cybersecurity measures; those

CII

operators,

36 Cybersecurity Strategy

improving

cybersecurity

considerationofoperationmeasures,

There isbased

effective

approaches,

systems

developmentmeasures include the separation of the systems

In addition, as for ICS, there has been the shift

for handling the affairs using the individual

to the openings of technologies and networks,

numbers prescribed under the Act on the Use ofe.g. the use of standard products and the

Numbers to Identify a Specific Individual in the

introduction of open-standard protocols.

Administrative Procedure from the Internet. The

a result, the use of ICS has become popular,

Government will also enhance monitoring andfor example, due to the replacement of theoversight mechanisms based on professional

existing equipment; on the other hand, thisand technical knowledge and experiences,

has created a pressing need for addressing

inentities.

vulnerability issues and unauthorized access.

Furthermore, aiming at building a monitoring

Under the circumstances, the Governmentand detection mechanism to supervise thewill collect, analyze, and disseminate usefulcoordinatedandinformation, e.g. information on vulnerabilities

local operation systems of the My Number

of ICS and ICS equipment and information

systems as a whole, the Government will build

on cyber attacks. It will be done based on theframeworks with capabilities of monitoring andinformation sharing arrangement in a good

prompt detection of cybersecurity incidents,

balance with the sharing of information on

taking account of possible information sharing

ICS and other than ICS. The Government willwith

Operation

promote the use of internationally approved

Coordination team (GSOC). Additionally, withthird-party certification schemes that enable

regard to the intergovernmental and public-

objective evaluations on the level of satisfactoryprivate coordination for authentication at the

security performance, taking into account thatoccasion of introducing the My Number system,

specialized knowledge and skills are necessary

the Government will also work to improvefor the procurement and operation of ICS andenvironments necessary to make the bestother associated equipment.

coordination

the

and

with

relevant

connected

Government

national

SecurityAsbalance between increased user-friendlinessand security assurance.
With regard to industrial control systems (ICS),
there is a concern that IT malfunction may

5.2.3

Measures for the Protection ofGovernmental Bodies

evoke the disruption of security assurance andAs for the governmental bodies and government-

the interruption of the provision of sustainable

related entities, the Government has addressed

services.

Smart meters in the electric powercybersecurity assurance by establishing andsupply services sector and factory automation

utilizing, as a main measure, the common

systems in chemical and petroleum industries

standards for the governmental bodies.

are good examples.

For the robust security

to these days, the Government has worked onassurance of ICS, it is necessary to reaffirm thefurther improving the standard of government-

importance of assuring the safety of ICS, bywide measures, and reflecting newly emerged

implementing information security measuresthreats and challenges in the common standards,

for ensured continuous service delivery.

where necessary.

Up

Cybersecurity Strategy 37

Meanwhile,itenvironment

will

rapidly by 2020.

is

that

social(1) Strengthening Defense Capabilities oftransformed

more

Information Systems and Promoting

expectedbe

It is anticipated that cyberattacks against the governmental bodies andMulti-layered

MeasuresagainstPresumed Cyber Attacks

government-related entities will become more

To respond to cyber attacks, such as targetedsophisticated and more manipulative; and that

attacks apparently aiming at stealing, damaging,

IT-related products and services would becomeor altering information, the Government willmore multi-functional and more diversified. In

take government-wide, multi-layered measuresanticipation of such rapid transformation, thebased upon the assumption of cyber attacks.

Government must be ready to face a dramaticThis must also include contingency plans for theincrease in cyber threats or unforeseen challenges

possibility – a certain entity would be used asaccompanied by that. Many of the informationa springboard for the entity that is the original

systems currently in the design or development

target of a cyber attack. In promoting theseplanning phases will be operational in 2020

measures, the Government will ensure thatand required to remain secured for many years

they are based on the common standards forto come.

Meanwhile, most of cybersecurity

the governmental bodies, and will conduct risk

measures cannot work like a quick remedy

analysis intending to perform its administrative

for cyber threats. In this context, it should be

responsibilities, for the optimization of thesetaken into account that cybersecurity assurance

measures as the entire governmental bodies.

in 2020 cannot be achievable unless proactive
actions are taken well in advance before newi. Preventing cybersecurity incidents

threats and challenges emerge.

The Government will robustly implement

Under the circumstances, the Government will

preventive measures, such as giving support

focus its forward-looking effort on the priorities

for announced software vulnerabilities andoutlined in the following sections, on thedetectedpremise of the continuous full implementation

signatures and certification technology, andof the ongoing cybersecurity measures, forwill make prompt and flexible readjustments

the governmental bodies and government-

corresponding to environmental changes.

related entities to take flexible and promptMorecounteractions to address not only existing

strengthen: cybersecurity-related information

threats and challenges but also unforeseen

gathering and analysis functions; and thethreats and other emerging concerns; at theorganizational arrangements for government-same time, the Government will incorporate

wide information sharing and for internal andthese priorities timely in the regulations, suchexternal coordination of the governmental

as the common standards for the governmental

bodies. The Government will also work on supply

bodies, and ensure the full implementation ofchain risk management and other measures tothese regulations by certain measures, such asincorporate cybersecurity assurance into theaudit and daily learning.

planning and designing phases of information

38 Cybersecurity Strategy

malwarespecifically,

and

the

utilizing

electronic

Governmentwillsystems.

Furthermore, the Government willcapabilitiesof

personnel

withdesignatedmake the prompt and flexible readjustments ofcybersecurity duties and the coordination

the measures taken for the information systems

among these personnel; and fully enforce

in operation, in view of environmental changes.

organizational

Additionally, the review and improvement

incidents under the direction of senior executiveof the implementation status of information

officers of each governmental body. Moreover,security measures will be undertaken throughfor risk reduction by the improvement ofpenetration tests and other examinations.

monitoring effectiveness and other means,

responses

tocybersecurity

the Government will work on the further
ii. Preventing damage and the spread of damage

reduction and consolidation of connections toIt

the Internet in the governmental informationisextremely

difficulttoprevent

allcybersecurity incidents, such as malicious

systems.

penetration into information systems by cyber

strive to: reinforce fact-finding activities in theattacks exploiting unrevealed vulnerabilities orcase of emergencies, including critical incidents

using malware, including Zero-Day attacks. For

involving a governmental body or governmental

this reason, while aiming to prevent the outbreakbodies; share the results of the fact-findingof cyber attacks, the Government remains

analysis in order to prevent the damage of theequally determined to respond to cybersecurity

incident from spreading; and incorporate themincidents effectively and in a timely manner inin the existing measures.

Additionally, the Government willorder to obtain early situational awareness andto limit the harmful consequences of an attackiii. Mitigating damage

as well as the spread of damage that the attack

For mitigating damage over the period startingmight cause.

from the incident occurrence to the completion

More specifically, the Government will workofon the enhancement of GSOC's functions

Government will take necessary measures tocovering the entire governmental bodies toprevent the spread of penetration and not todetect and analyze cybersecurity incidents;

allow attackers to accomplish the purpose(s) of

the enhancement of a CSIRT, situational

their attacks.

awareness, and risk management functions ofMore specifically, for the purpose of making

every governmental body; and the acceleration

it harder to carry out unauthorized access toand sophistication of information provision andpersonal information, sensitive information,

sharing in the case of a cybersecurity incident.

and other highly confidential and integral data,

At the same time, the Government willi.e. those of which breach and alteration would

implement training and exercises for incident

cause serious negative impacts on the people,

readiness and subsequently incorporate lessons

society, and more, the Government will strive tolearned from such training and exercises inachieve more trusted information management,

its cybersecurity policies and measures; theincluding the separation of information systems

Government will also aim to: improve theaccording to the substance of administrative

theinitiated

emergency

measure,the

Cybersecurity Strategy 39

functions as well as the nature and quantities

the promotion of government-wide informationof information processed, and the use of

sharing on cybersecurity incidents and active

operational regulations. The Government will

dialogues. In addition, since human resources

also accelerate its effort to implement "defense-

are the key of organized risk management,

in-depth" measures against targeted attacks,

the Government will work to ensure enhanced

including those concerning system availability,

cybersecurity

such as system breakdown.

In addition, theincluding senior executive officers. At the same

Government will work to establish methods totime, the Government will plan to foster andevaluate priorities regarding the enhancement

acquire cyber talent who will take a leading roleof: incident response corresponding to different

to advance response capabilities of each entity;risks and their impacts; and focused measuresthis will be done by utilizing qualifications andfor information systems.

other special skills as one of objective criteria toliteracyintheentirestaff

evaluate individuals' competencies.

(2) Achieving More Resilient
Organizational Response Capabilities(3) Adapting to Technological

The Government will seek to achieve more

Advancement and Change inresilient organizational response capabilities

Business Performance Styles

for more flexible and prompt responses to

To perform administrative functions in aaccelerating changes.

way

The following are examples of the planned

rationalization of administrative affairs by theactivities: the review and improvement ofutilization of multi-functioned and diversified

organizational arrangements and frameworks

IT products and services, and in a way to meet

to

the

the demands of the digital era, the Government

governmental bodies and government-related

will make efforts to prevent incidents andentities, by conducting periodic self-assessment,

the deterioration of security standards due

management

independent

to the inappropriate use of new IT products

perspective, and other examinations; and theand services, while paying due attention topromotion of risk-based and organized measures

cybersecurity assurance.

for and management of information systems,

More specifically, the Government is planningsuch as the formulation of risk management

to: collect the government-wide status data

policies and the standards of measures on aregarding the adoption of new IT products

basis of risk assessment, the establishment

and services as well as the information onof a scheme for contingency planning based

implemented measures; establish the common

on consensus of stakeholders for unforeseenmeasures across the governmental bodies;circumstances, and so on.

Since there is no

and put them into force, taking into accountpanacea for responding to unknown threats andthe characteristics of these IT products andother cyber concerns, the Government will also

services. In terms of the changes in the styles

plan to create a community that contributes toof performing administrative functions basedenhancemeasuresaudit

40 Cybersecurity Strategy

fromconcerninganadjustingtothesophisticationandon the IT use, the relevant governmental bodies

professional knowledge and skills, and will takeand government-related entities will closely

appropriate actions, where necessary.

collaborate to adapt the performance styles
appropriately, based on assured cybersecurity.

(4) Comprehensively Enhancing
Measures through the Extended
Scope of Monitoring and OthersTostrengthen

cybersecurity

throughout

the governmental bodies as a whole, theGovernment

will

strivefortheoverallenhancement of measures in incorporated
administrative agencies, special corporations
closely working with the governmental bodies
to perform their public functions, and otherrelevant entities.
More specifically, the Government will workon: the improvement of incident response
capabilities of such entities; the enhancementof audit of such entities by their competent
ministries; and the promotion of cybersecurity
measures at such entities, in accordance withthe governmental measures (as described abovefrom (1) to (3)), taking into consideration theircharacteristics and others.

The Government

will: particularly add such entities to thesubjects of monitoring by the GSOC in a phasedmanner, taking into consideration equitableburden sharing among beneficiaries; include
such entities as the subjects of audit and factfinding activities that the NISC conducts as amandate given by the Cybersecurity Strategy
Headquarters; and carry out other necessary
measures.

For the enhancement of thesemeasures,theGovernment

promptly

thenecessary

will

revisions

examineoftherelevant laws, in view of possible arrangement
for coordination with relevant entities having
Cybersecurity Strategy 41

5.3

Ensuring Peace and Stability of theInternational Community and National SecurityJapanstrongly

possession,

disapproves

control,ofcensorship,

exclusive
the

theft

or destruction of information by autocratic

A free, fair, and secure cyberspace is a shared

regimes as well as malicious use of cyberspace

global space where communications in a global

by non-state actors including terrorists. Japan

scale are available, and is a foundation for peace

will proactively contribute to the maintenanceand stability of the international community.

of international order and ensure its national

In

that

security by building peace and stability of therecognizing the diversity of values, respecting

international community from the policy ofautonomy and securing people's freedom of"Proactive Contribution to Peace" based on the

speech and corporate activities in cyberspace

principle of international cooperation.

based on the rule of law will bring peace andUnder the above recognition, Japan adopts thestability

following strategic approaches for building

particular,

to

Japan

the

firmlybelieves

international

community,

thereby ushering in prosperity for all. Indeed,

peaceJapan has built an economy and society where

community as well as national security.

an extremely high-quality life and sustainable

the implementation of these measures, Japandevelopment are possible, through utilizing thewill further advance the centralization of

benefits of free, fair, and secure cyberspace. On

relevant information including information on

the other hand, domestically and internationally,

cybersecurity measures of the governmentalsocial systems' dependency on cyberspacebodies and relevant entities to the Cabinet

has been increasing and thus the situation in

Secretariat, and enhance its common external

which cyber attacks significantly affect the

responses.

andstabilityoftheinternationalForsocio-economic activities in the real world withsophisticated method and with greater impact isarising. Under these circumstances, defending

5.3.1 Ensuring National Security

cyberspace from cyber attacks and ensuring its

As all kinds of physical objects, including

secure use are critically important challenges

social systems, are networked and cyberspacefor peace and stability of the international

is increasingly integrated with the real world,

community and national security, which must

many organizations have heavily relied upon

be addressed imminently and drastically.

cyberspace.

Addressing these challenges to ensure Japan's

become capable of causing tremendous damages

security, Japan will drastically enhance theto a state's politics, society, economy, andresponse capabilities of the whole nation andculture. Nowadays, cyberspace is a sphere notfurther engage in cooperation and collaboration

only of economic activities but also of nationalwith the ally and like-minded countries as wellsecurity and intelligence activities. Disruptive

as confidence building measures with relevant

activities, theft of classified information andstates.

In addition, from the viewpoint ofalteration of data by organized, well-prepared,

pursuing a free, fair, and secure cyberspace,and advanced cyber attacks, including those

42 Cybersecurity Strategy

As a result, cyber attacks havethat might be state-sponsored, are actual threats

with military operations in the real world, it istoday.

essential to proactively promote cooperation

To protect cyberspace from these advanced

and collaboration with the ally and like-mindedcyber attacks, it is necessary to take prompt

countries or organizations on sharing threat

and appropriate measures based on advanced

information and human resources development

knowledge at all phases: prevention, detection,

among others. It is also important to promote

and response.

confidence building with other countries.

For this reason, throughanalyzing cyberspace in peacetime, Japanintends to further enhance its capabilities of(1) Enhancing Response Capabilities of

early identification and situational awareness

Relevant Governmental Bodies

including the signs of cyber attacks by various

In order to respond to more diversified andactors, and of detecting and addressing threats

complex cyber threats, it is critical to enhance

promptly. To this end, it is critical to strengthen

Japan's whole resiliency and capabilities. To thisthe Government's functions of information

end, Japan will strengthen the capabilities of law

gathering and situational awareness, including

enforcement agencies, the Self-Defense Forces,

information sharing with foreign governmental

and other relevant organizations, both in quality

entities,toand quantity. In order for these organizations topromote cross-sectoral and cross-cutting efforts

play full part, Japan will consider a wide range

comprehensively.

of effective means such as reviewing various

It is necessary for national security to protectorganizational frameworks, including humanthe function of social systems owned by the

resources development and recruiting, theGovernment and CII operators from cyber

introduction and learning of latest technologies,

attacks.

Regardless of the public or privateand R&D. In addition, to counter cyber attacks

sector, a vertically-segmented structure andtargeting the classified information owned byrigid conventionalism are favorable conditions

the governmental bodies, Japan will promote

for attackers.

Based on such a shared

the efforts related to counter-cyber-intelligence

understanding, Japan will further strengthen

in the Cabinet Intelligence and Research Officecurrent cooperation with various relevant actors,

and other relevant entities.

andsituational

analysis,andand achieve a seamless and multi-layered
protection against these attacks. In addition,
Japan will enhance its response capabilities(2) Utilizing and Protecting Japan's
Advanced Technology

against cyber attacks, which can occur at any

Japan's advanced technology is not just forphases, appropriately and accordingly to theirsecuring Japan's economic advantages but also

scale and level.

a critical national asset in terms of national

Furthermore, bearing in mind that cyber attacks

security.

can be easily conducted across national borders,

critical information for national security, e.g.

and there are some cases in which cybertechnologies related to outer space, nuclear

attacks might be state-sponsored or linked

energy, security, and equipment of the Self-

In particular, actors who deal with

Cybersecurity Strategy 43

Defense Forces, need to keep in mind thatfeasible measures with a clear recognition ofcritical information could become a possible

how the effect of cyber attacks on the provision

targetTheseof services will impact the executions of theactors will take all feasible means to ensure

missions of the governmental bodies and thetheir cybersecurity so that Japan's advanced

business operators themselves.

technology will be utilized for the assurance

In this context, Japan and business operatorsof national security. Relevant actors will workin charge of CII and other social systems will

to increase awareness of cybersecurity for all

further enhance their daily efforts to bring,people involved in advanced technology, andshare, and analyze beneficial information,

take necessary measures, including: enhancing

such as vulnerabilities and attack information,

monitoring of and response capabilities against

and address to threats in a necessary manner.

cyber attacks from abroad; tightening the

It is also expected to accelerate interactive

examination and verification of goods andinformation exchange between the public andservices obtained externally; strengthening

private sectors.

collaboration between the public and private

As the defense authorities, the Ministry of

sectors for information sharing and others.

Defense and the Self-Defense Forces will furtherofglobalcyber

attackers.

enhance the defense of their own networks and(3) Protecting Governmental Bodies
and Social Systems

infrastructure, and deepen coordination withstakeholders relevant to the assurance of the

As the governmental bodies have a mission

missions of the Self-Defense Forces in light of

to defend and support the people's living andthe possibility that cyber attacks against social

socio-economic activities, the shutdown ofsystems indicated above may become a major

their functions is a significant concern to theimpediment to the accomplishment of theirnational security.

missions.

The execution of missionsof the governmental bodies relies on CII andother services provided by business operators

5.3.2

Maintaining Peace and Stability of
the International Community

responsible for social systems.

These business

operators

animportantprovideservices

Ensuring both cybersecurity and the free flow

indispensable for the people and society.

of information at a global scale is necessary

Therefore, ensuring cybersecurity of these CII

for peace and stability of the international

operators is of extreme importance for national

community.

security and the assurance of the missions

Cyberspace is a space where data is transmittedof the governmental bodies as well as theand processed through hardware and software,continuous provision of services indispensable

which are managed and operated by various

for the people and society. To this end, it isactors all over the world, both global andnecessary for these operators, in collaboration

national, and linked by autonomous andwith the governmental bodies, to take allcooperative networks.

missionthemselves
to

have

continuously

44 Cybersecurity Strategy

In order to have

active communications as well as social,i. Developing international rules and norms

economic, and cultural activities in such aJapan is of the view that existing international

space in international nature, it is necessary

law is applicable to cyberspace. With regard toto ensure appropriate security of the aforesaid

security in cyberspace, Japan has participatedcomponents spreading across the countries inin the Group of Governmental Experts (GGE)

the world so that people can utilize cyberspaceestablished in the First Committee of the UN

feeling safe and secured.

General Assembly, and the GGE submitted a

Through the free flow of information at a global

report indicating that existing international law

scale, cyberspace has become a foundation

is applicable to acts using cyberspace. Japanfor all kinds of social, economic, and cultural

will further actively engage in the discussions

activities on earth, and has promoted mutualonunderstanding across national borders.

This

international laws, and subsequently contribute

remarkable global nature of cyberspace would

to the development of international rules andbe undermined if the authorities divide it withnorms regarding cyberspace with the view

their excessive restrictions or control. In addition,that existing international law is applicable toin order to ensure security of cyberspace, it iscyberspace.

imperative that Japan will implement measures

In addition to the GGE, there have been

todiscussions

amongenvironment that leads to peace and stability offocusing

thethe international community as well as of Japan.

Internet governance and other topics in various

Under this recognition, with a view to build

fora, including the UN and its specializedpeaceinternationalorganizations, the Organisation for Economic

community, Japan will take a leading role as

Co-operation and Development (OECD), thea responsible member of the international

Asia-Pacific Economic Cooperation (APEC) andcommunity,

ensuring

the Global Conference on Cyberspace. Japancybersecurity through international cooperation

will further cooperate with domestic and foreign

with various stakeholders as well as securing thestakeholders in these discussions and actively

free flow of information at a global scale based

promote the development of international ruleson the following policies.

and norms with a view that ensuring openness,createandaninternationallystability

and

of

the

engagestable

in

cyber

the

application

onofspecific

individual

multi-stakeholders

socio-economic

aspect,interoperability, autonomy and the free flow

(1) Establishing the International Ruleof Law in Cyberspace
Recognizing the diversity of actors and values,of information in cyberspace will make asignificant contribution to the development ofsociety, economy, and culture.

Japan will take active roles in establishing theinternational rule of law in cyberspace, with theii. Materializing international rules and norms

basic principle of the free flow of information.

While making efforts to develop internationalrules and norms for cyberspace, Japan willproactively proceed with their realization.
Cybersecurity Strategy 45

For instance, in the security field, Japan willby creating multi-layered contact mechanisms,

promotemeasures,e.g. points of contact among countries or theas described later, in cyber dialogues withprivate sectors, for transnational cybersecurity

international organizations and countries based

incidents during peacetime and conduct contact

on the results of discussions on the application

exercises and other measures.

confidencebuildingof a specific individual international law. With
regard to measures against cybercrimes, as a(3) Tackling Activities of International

Party to the Convention on Cybercrime, Japan

Terrorist Organizations Maliciously

will promote the expansion of its Parties,

Using Cyberspacestrengthen international cooperation among

In order for cyberspace to remain a domain

law enforcement authorities for a promptthat contributes to peace and stability of theandinvestigation,international community, it is necessary toand promote international investigation for

deter the activities of international terrorist

arresting transnational criminals to effectively

organizations

address

cyberspace. With the expansion of cyberspace,effective

assistancecybercrime

that

in

easilytranscends

that

have

maliciously

national borders. Japan will take an initiative

non-governmental

in

and

extremism have been using cyberspace fornorms and subsequently make contributions

malicious purposes such as the dissemination

to the establishment of the rule of law inand demonstration of ideas, recruiting andcyberspace and bring peace and stability to thesolicitation, and fund-raising for terrorism.

international community.

Takingimplementing

international

rules

into

actorsaccount

that

used

the

advocateinternational

statements such as the resolutions of UN(2) Building International Confidence
Measures

SecurityCouncil,

Japan

must

carry

out

measures against such international terrorist

Cyberspace has become a basis for all kinds

organizationsof activities, including social and economic

international community. For this, Japan will

activities as well as military operations. Undertake necessary measures, e.g. strengthening

such circumstances, it is necessary to promote

information gathering and analysis on theinternational discussions at the UN and otheractivities of international terrorist organizations

fora on how to prevent unexpected situations

in cyberspace, including the utilization ofstemming from cyber attacks and share common

technologies

understanding among many countries. To thisinformation on the Internet.

in

that

coordination

gatherwiththeterrorism-relatedend, Japan will actively provide information on
its fundamental viewpoint and share it withmany countries at multilateral conferences,(4) Cooperating for Cybersecurity
Capacity Building

such as the UN, as well as bilaterally in cyber

As a responsible member of the international

dialogues and conferences.

community

Moreover, Japan

will promote international confidence building
46 Cybersecurity Strategy

foundedonfreedomanddemocracy, Japan will actively engage incapacity building of other countries based on its

community with a basic principle of the free flow

experience and accumulated knowledge.

of information. To this end, the Government

It is necessary for various actors aroundand relevant entities will work together on thethe world to cooperate and address thedevelopment of capacity building measures andtransnational threats in cyberspace as the lacktheir efficient and effective implementation.

of competence of some countries or regions
to address these threats would be a risk for(5) Developing World-Class Human
Resources

the entire world including Japan. In fact, it isconfirmed that many cyber attacks against

In addressing these international cybersecurity

Japan have come from abroad.

efforts, it is necessary for Japan to continuously

In addition, the activities of the Japanese people

participate in and contribute to internationaland companies are globalizing and the number

conferences to state its position and deepenof people traveling abroad and enterprises

communications with various actors aroundexpanding overseas are increasing.

the world. The participants of such conferences

With thedevelopment of informatization, these activities

would

have become increasingly reliant on cyberspacecybersecurity expertise as well as understanding

and social infrastructure managed and operated

on the context of each country's society,by the countries of their destinations.

economy, culture and other aspects. Therefore,

For these reasons, cooperation on capacity

Japan will develop, in both the public and privatebuilding to ensure cybersecurity of countries

sectors, abundant world-class human resources

around the world would not only contributehaving technical expertise on cyberspace, well-to those countries that need the assistance onversed in international relations, international

cybersecurity but also benefit Japan and the

security, international cooperation among otherentire world.

fields, and capable of successfully working in

With

the

development

communications
promotingandsociety,thestatutesandofinformation

Japan

has

been

development

of

laws

policyframeworks

forcybersecurity, and it has engaged in theberequiredtohavesufficientthe international arena.

5.3.3

Cooperation and Collaboration
with Countries around the Worldassurance of cybersecurity of governmental

Bybodies, CII operators, other organizations, andcountries around the world, Japan will realize

individuals;

peace

human

measuresresources

againstdevelopment

cybercrimes;tofostercooperation
andcommunity

andinpartnerships

stability

of

the

as

as

national

well

with

international
security.

cybersecurity experts; and R&D of cybersecurity

International cooperation and partnerships

technologies. Based on these experiences andalso contributes to the strengthening ofaccumulated knowledge, Japan will further

international capabilities to counter cyber

actively cooperate on capacity building as

attacks in which state actors might be involved.

a responsible member of the international

On the basis of the Japan-U.S. Alliance,
Cybersecurity Strategy 47

Japan will keep in mind its geographical andcultural situations of each ASEAN country, andeconomic relation or the extent of shared values

the various views towards cyberspace, Japan

with partner countries, and as a responsible

will enhance bilateral cooperation with eachmember of international community founded

member country.

on freedom and democracy, Japan will expand

Japan will strengthen its cooperation andand develop cooperation with other countries.

partnerships with regional strategic partners

In addition, from a perspective of avoiding andthat share basic values with Japan.

preventing contingencies arising from cyber

will enhance bilateral cooperation in theattacks, Japan will make efforts in confidence

cybersecurity field through various channels

building, establish international cooperation

between those countries, such as the sharing

frameworks in various fields, and ensure

and utilization of information on cybersecurity-

cyberspace security.

relatedpolicies

and

cyber

attacks

Japan

from

peacetime; and joint training on cyber attacks,(1) Asia Pacificand will address challenges in cyberspace in the

The Asia Pacific region has a deep historicalregional and international arena, hand in hand.

connection with Japan, and the flow of people

Japan will also exchange its views towards

among nations and investment by Japanesecyberspace or information on cybersecurity

companies are increasing.

As a responsible

strategies, discuss the possibility of cooperation

member of this region, Japan will vigorously

in the cybersecurity field, and deepen mutual

promote international partnerships in theunderstanding and partnerships with othercybersecurity

countries in the Asia Pacific region.

field,

cooperation

towardsJapan

capacity building, and collecting and sending

will also actively participate in the regional

information in this region, through many kinds

frameworks, such as APEC and the ASEAN

of bilateral and multilateral channels.

Regional Forum (ARF), and take part in theJapan has a history of partnership with ASEAN

development of economy, society, and culture

for more than 40 years. In the cybersecurity

by ensuring security and the free flow offield, Japan has a close and cooperative

information in regional cyberspace.

relationship through multiple channels suchas the Japan-ASEAN Information Security(2) North America

Policy Meeting.

Through the framework of

Based on shared basic values, Japan will promoteinternational conferences or joint projects, andits cooperation with the North America region in

the continuous implementation of various andthe cybersecurity field. In particular, the Unitedpractical capacity building based on the needs

States is Japan's ally that closely cooperates atof each country, Japan will further deepen andevery level, based on the Japan-U.S. Security

expand cooperation in the cybersecurity field

Arrangements. Japan and the United States alsowith ASEAN countries, and actively contribute toshare common values related to cyberspace.

the realization of resilient cyberspace of ASEAN.

Both countries closely cooperate and share

In addition, considering economic, social, andinformation through the Japan-U.S. Cyber

48 Cybersecurity Strategy

Dialogue, the Japan-U.S. Policy Cooperation

will further strengthen cooperation with each

Dialogue on the Internet Economy, the Japan-

country and relevant organizations of Europe,

U.S. Cyber Defense Policy Working Group,

through various channels, including defense

and other various bilateral channels.

Japan

authorities; for instance, Japan will promote

will continuously deepen its cooperation withthe sharing and utilization of information

the United States in a concrete manner, suchon cybersecurity-related policies and cyberas the sharing and utilization of information

attacks from peacetime, joint training against

on cybersecurity-related policies and cyber

cyber attacks, joint projects in the field of

attacks; response to cybersecurity incidents;

advanced technologies, as well as response to

and the implementation of joint projects in theand cooperation on cyberspace issues in thearea of state-of-the-art technologies. Japan willinternational arena.

also closely cooperate with the United States
in responding to a wide range of cyberspaceissues in the international arena, including(4) Latin America and the Caribbean,
Middle East and AfricaofRegarding the Latin America and the Caribbean

international norms and rules, international

region as well as the Middle East and Africa

security,will

region, Japan will build and strengthen its

work together for peace and stability of thepartnerships with countries that share common

international community.

values with Japan, and consider the possibility

Furthermore, the defense authorities of bothof cooperation and partnerships with othercountries will promote cyber threat-related

countries on capacity building and otherinformation sharing, joint training against cybermeasures.

thedevelopment
and

and

implementation

Internet

governance,

attacks, and cooperation for human resources
development;

andstrengthen

operational

cooperation between the Self-Defense Forces
and the United States Armed Forces under
the new Guidelines for Japan-U.S. Defense
Cooperation.

By solidifying the whole-of-government cooperation, Japan will enhance
theU.S.-Japan

Alliance's

deterrence

andresponse capabilities.

(3) Europe
European countries which share basic values
and principles, e.g. market economy, areJapan's partners that take leading roles inbuilding peace and stability of the international
community. As for the cyberspace issues, Japan
Cybersecurity Strategy 49

cybersecurity technologies in comprehensive

Cross-Cutting Approaches
to Cybersecurity

5.4

R&D areas, including networks, hardware,and software. In line with the following R&D

In order to achieve the three policy goals –policies, the Government will promote R&D

improvingandin coordination with relevant stakeholders,sustainable development; building a society

by profiting from the combination of diverse

where the people can live safe and secure lives; andinformation, perspectives, and advantages held

ensuring peace and stability of the internationalby each stakeholder.

socio-economic

vitality

community and national security –, it is imperative
for the Government to make a tireless effort for(1) Improving Detection and Defense

advancing prominent research and technological

Capabilities against Cyber Attacks

development and fostering outstanding talent

For the protection of the Government, CII,

as the engine for the accomplishment of theseenterprises, organizations, and individuals fromgoals. Such cross-cutting approaches require acyber threats, including more sophisticatedlong period of time to produce tangible results

and more complex cyber attacks, in theand require a wide range of activities as well;interconnected

the Government will take steps in mid and longsociety where the IoT systems have prevailed,term perspectives, and will make progress in

it is required to further advance detection

these activities by harnessing relevant public-

and defense capabilities based on a better

private business partnerships or arrangements

understanding of actual situations.

and those of relevant governmental bodies.

capacity building in this regard requires theandconverged

information

R&D forprofound environmental improvement thatenables R&D to be implemented with a good

5.4.1 Advancement of R&D

grasp of actual threats and concrete needs.

ICTs have been interwoven with the people's

Additional attention should be paid to the pointsocial activities and used more widely inthat it is important to put cybersecurity R&D

their economic activities, too, as the drivers

into practical use with consideration of social

of innovation.

Along with the significant

needs and promote the active utilization of R&D

expansion of networked systems and devices,

accomplishments in society. To this end, theincluding those utilized by CII and others,

Government will promote information and data

now more than ever, there is a growing needsharing necessary for governmental bodies,forresearchers, and other relevant stakeholders

cybersecurity

measures

taken

by

the

Government, private enterprises, and otherin a user-friendly manner.

relevant stakeholders. To combat evolving cyberboost resilience against cyber attacks, dataattacks which have become more advanced,

suitable for academic evaluation, including

more sophisticated, and more complex on athe data transmitted in M2M systems, will bedaily basis, it is crucial to promote productive

continuously collected in actual environments,

R&D

and subsequently used for the development

toinvent50 Cybersecurity Strategy

creativeandinnovative

For example, toof data analysis technologies.

Moreover, the(3) Securing Cybersecurity CoreTechnologies

Government will initiate necessary actions,
including the examination of relevant laws

To predict and address cyber threats, including

and statutes as well as standards concerning

cyber attacks that are evolving every day, it isresearch. It is also the Government's plan tovital for Japan to secure its core technologies

improve defense capabilities, for example, by

required to make self-reliant efforts for theincorporating cybersecurity into the planninginvention and development of technologicalphase of the R&D projects promoted by thefundamentals of cyber attacks and cyber

Government.

defense, the frameworks of systems, and so on.
With regard to basic research that fosters core(2) Promoting Interdisciplinary

technologies, although they may not be exactly

Research on Cybersecurity

profitable in terms of business revenue, it should

In combatting cyber threats, it is not sufficient

be noted that some of them, e.g. cryptographic

enough anymore merely to consider risks on

research, will become a potential source of

information systems or conduct academic

newresearch, since the impacts of cyberspacewith successful entrepreneurial ventures orin the real world have increased due to theprospective

advancedandmanagement and development capabilities, andIt requires the explorationthat there are mission-essential technologies

of analysis methodologies across multiple

from a national security viewpoint and for otherareas, including laws and statutes, policies,

reasons. For this, the Government will seek tocurrent affairs, and technologies.

From thismake steady progress in building supportive

standpoint, the Government will promote: theenvironments for R&D at appropriate researchcollaboration with multidisciplinary research

institutes, such as public research institutes,

that encompasses various fields, including social

universities, and other relevant organizations.

integration

physical space.

ofcyberspacebusiness

opportunities,

stakeholders

ifhavingpartneredbusinesssciences perspectives, e.g. law, international
relations, international security, and business
management; the promotion of research on(4) Enhancing R&D in International
Coordination

cybersecurity in interdisciplinary fields; and the

As for technological measures to tackle cyber

examinations and R&D in a way to look ahead tothreats that have become more advanced andfuture social and technological transformation,

more sophisticated, in order to develop moresuch as Big Data and Artificial Intelligence (AI).

progressive technologies for internationally-

Needless to say, the results of various R&D,

coordinated measures that enable accurate

including those in the fields of science andresponses to such cyber threats, it is highly

technologies, must not produce adverse effects

effective that "unique" technologies of different

in human society.

countries

areorganicallyintegrated

each

other and developed in such linkage, since
cyber attacks are launched beyond national
Cybersecurity Strategy 51

borders. The Government will work hard on

domestic shortage of cybersecurity experts,

R&D in international coordination, paying

both in quality and quantity.12 As described in

careful attention to research contents andthe following sections, the Government will

national security concerns. As part of ongoing

make efforts to: expand cybersecurity education

collaborative efforts for various internationaland education in cybersecurity-related fields;

standardizations, the Government will also

identify, foster, and recruit talented individuals;

striveand create career paths in a long term perspectiveto:establish

anddisseminate

thevarious international standards; and build thefor cybersecurity-related personnel.

frameworks for mutual recognition related tothecybersecurity technologies and others.

to promote human resources development

Governmentwill

establish

Overall,guidelines

comprehensively and soundly.

(5) Partnering with Relevant Entities

It should be noted that it is necessary for

R&D achievement cannot be made overnight;

such human resources to develop not only

it is a task requiring long term engagement. It

technological capabilities but also high ethicalis a common challenge not only for the fieldstandards.

of cybersecurity but also for other fields ofresearch to build R&D supportive environment(1) Promoting Human Resources

and nurture researchers. The Government will

Development Corresponding topromote active measures comprehensively in

Social Needs in Higher Educationindustry-academia-public coordination, taking

and Vocational Training

cybersecurity viewpoints and environmental

Regarding highly skilled experts who will leadchanges into account, and in coordinationa future society, it is necessary to implementwith the Council for Science, Technology andtheInnovation and other relevant organizations

resources development that matches socialthat are major stakeholders of such measures.11

needs, in more organic industry-academia-

quantitative

andpublic coordination.

Development and Assurance of
5.4.2
Cybersecurity Workforce

qualitative

human

The Government will

support higher education institutions, such as
graduate schools, universities, and colleges oftechnology to implement programs to offer

Today, ICTs are widely ingrained in the people's

students learning opportunities to develop aliving as the social foundation. In the emerging

solid foundation in both the basic theory andinterconnected

practice of cybersecurity and to advance theirandconverged

informationsociety, cybersecurity is an essential literacy,practical cybersecurity skills.

to one degree or another, for a variety of

the Government will encourage these higher

human resources, from cybersecurity experts

education institutions to ensure that theseand conventional ICTs experts to IoT users.

programs will have a component to evaluate

Cybersecurity workforce development is a

students' basic qualities, in terms of whetherpressing task for Japan, as there is a criticalor not they would have sufficient knowledge,

52 Cybersecurity Strategy

In this regard,competencies, and other elements, as required.

expansion of opportunities for practical exercises

Furthermore, for building industry-academia-

in industry-academia-public coordination, andpublic partnerships, the Government will promote

the promotion of the active use of vocational

measures of practical exercises for human resources

training.

development, such as developing an environment forcyber exercises in a cloud environment and supporting(2) Expanding Elementary andeducational material development through industry-

Secondary Education for

academia-public partnerships, in addition to the

Cybersecurity

improvement of close coordination and information

Insharing among them.

information society, it is the essential foundation

In

the

current

interconnectedandconverged

wherefor enriching and developing the people's

cybersecurity has become a business-essentialsocio-economic activities and living that thechallenge

management,

IoT systems and other ICTs are fully available

e.g. enterprise business management, thefor use by all actors, including individuals,role of the intermediators capable of dualistic

enterprises, and governmental entities.

thinking, both from management strategy andthis society, cybersecurity is a literacy, to one

technological viewpoints, is highly important; it

degree or another, required for everyone.

is because they can work as moderators between

Cybersecurity literacy includes logical thinking

the board level and security-related professional

capability and understandings of ICTs as wellpersonnel, and as a result, can work to promoteas the basic mechanisms of equipment. It is

the appropriate allocation of business resources

vital to cultivate such literacy based on school

to security. In this sense, the Government willchildren's developmental stages starting fromsupport higher education institutions to develop

the"hybrid" human resources or individuals multi-

levels. Moreover, learning cybersecurity at the

talented with comprehensive knowledge andpre-tertiary education level is critical for theskills in various fields, from cybersecurity anddevelopment of cybersecurity experts at the

ICTs, social sciences such as law and businesshigher education stage; pre-tertiary learning ismanagement, to organizational management

equally required for conventional ICTs experts

and others.

and ICTs users to become cybersecurity literate.

For the provision of secured products andThe

services, cybersecurity-related knowledge iselementary

indispensable in engaging in the manufacture offor:products and services. Taking into consideration

understanding of information, and participatorythat cybersecurity is an essential literacy for

attitudes

multiple people, from experts in all of the ICTs-

facilitating

related fields to ICTs users, the Government will

morality, including information security, andexamine possible measures, including recurrent

other associated understandings; and fostering

education at higher education institutions, thelogical thinking capability and understandingsforcircumstancestheorganizational

elementary

andGovernment
andnurturing

secondarywill

towards

education

further

secondarypractical
thepromoteeducation

skills,data-driven

understandingofIn

scientificsociety;

information

Cybersecurity Strategy 53

of ICTs as well as the basic mechanisms of(4) Building Long Term Career Paths
for Cybersecurity Experts

equipment, and more. It is also the Government's
plan to improve and expand training and otherA majority of organizations are using ICTs as

activities for teachers to improve their ICTs-

a tool to achieve their business objectives.

based teaching capabilities.

This means that organizations using ICTsare(3) Discovering, Fostering, andrequiredtoaddress

cybersecurity

their business management issue.

as

At these

Acquiring the Best Brainsorganizations, all business levels, from theas Global Players

operational level to the board level, need to be

With regard to cybersecurity-related humanequipped by human capacity with cybersecurity

resources, the Government will continue toexpertise to ensure cybersecurity readiness,make efforts to discover the best brains, inbased on the different needs at each business

addition to promote cybersecurity educationlevel. As for cybersecurity-related businesses,

offered by educational institutions, such as

their human resources challenge is to employ

graduate schools engaging in cybersecurity-

not only cybersecurity-specific personnel but

specific advanced research cooperation.

also those who perform supervisory duties

It isalso aimed to promote the development offor them.

self-help cybersecurity capabilities to examine

paths corresponding with the organizational

appropriate

throughneeds will be beneficial for enterprise seniorresearch on various methods of counteractions

executives, educated cybersecurity personnel,

against cyber attacks, including defensive andand human resources developers.

offensive methods.

In this regard, the Government will aim at

Moreover, given the fact that cybersecurity has

creating a virtuous circle of supply and demand

become a global challenge, such the best brainsofare expected to become globally competent; inmeasures: the visualization of competency, byother words, it needs to nurture individuals whodeveloping qualification schemes to evaluate

are capable of working across national borders.

cybersecurity-related personnel's practical skills

For this reason, the Government will actively

timely and appropriately and by establishinglaunch various initiatives, such as more supports

the standards of basic skills required to perform

for organizing contest events by inviting

assignedoverseas participants, and building networks

promotion of activities for better matching of

among exceptionally talented individuals. With

occupational supply and demand, including

such initiatives, the best national brains will

the expansion of internship opportunities,

become more motivated by knowing their levels

with consideration of the nature of businessesof cybersecurity skills compared with the global

concerned and host organizations' needs; thestandards, while staying in Japan.

development of career paths for cybersecurity

incident

responses,

Moreover, to build specific careerhuman

resources

functionsatthrough

appropriateorganizations;thehuman resources across industries, academia,
and the public sector; the promotion of other
54 Cybersecurity Strategy

relevant measures in various perspectives,
including business finance, and so on.

5

Industry related to IoT systems, including the provision ofdevices and services.

(5) Strategizing Human Resources

6

Development for Enhanced

purposes, element technology, and others.

Organizational Capacities
There are rapidly increasing and aggravating

7

installation,andoperationofdevices(including IC chips) and systems; these risks include a

and/or a sector, including the governmental

risk that viruses and malicious programs might be installed
during these processes.

To tackle cyberattacks in an accurate and timely manner, it is

Risks existing in the processes of design, production,
procurement,

cyber attacks that target a whole organization
bodies and CII operators.

A practice or a process of analyzing and disassembling
software and hardware to uncover structures, specifications,

8

2004 Ministry of Internal Affairs and Communications
Bulletin No. 695.

not enough to make the efforts of individuals to

The Guidelines were establishedwith the purposes of improving the user-friendliness ofenhance their cyber defense capabilities; whattelecommunications services and protecting consumers’is important is aligning these individual efforts

rights and interests, by establishing basic proceduresin an organic fashion for building enhanced

in terms of proper handling of information considered asorganizational

capacity.

For

the

respected by telecommunications business operators
secrecy of communications and other personal information.

overallorganizational improvement of cybersecurity

9

10

2014

by

the

Information

Information

andcommunications

services,

financial

power supply services, gas supply services, government
and administrative services (including local governments),

individual organizations grasp their current

medicallevels of practical skills as well as challenges

services,

water

services,

logistics

services,chemical industries, credit card services, and petroleum

specifically.

industries.

For this reason, the Government will work
systematize

make

19,

services, aviation services, railway services, electric

through friendly competition, while helping

necessary

May

Cybersecurity Strategic Headquarters.

crucial to create an environment where different

toon

Security Policy Council: revised on May 25, 2015 by thecapabilities in an effective and efficient way, it isorganizations could learn from each other

Establishedtoorganizationalcounterpractical

cyber

exercise11

capabilities
attacks,

activities

example,“Ensuring

Cybersecurity

inCriticalInformation Infrastructure, etc.” was selected as a
candidate of a new research project for the “Cross-andMinisterial Strategic Innovation Promotion Program (SIP)”

more

at the Council for Science, Technology and Innovation on
June 18, 2015.

comprehensive to improve such organizational
capabilities. The enhancement of the public-

For

12

According to the estimate of May 2013 made by theprivate collaboration frameworks will be also

Information-Technology Promotion Agency, Japan (IPA),

undertaken by the Government for the purposes

field of information security; among them, however, only

there were approximately 265,000 experts working in theof collective damage control and recurrence

around 105,000 experts were considered to have required

prevention or reduction in the event of serious

required some kind of education or training to acquire thecyber attacks or other cybersecurity incidents.

skills to perform their duties, and the rest of 160,000 were
lacked skills. On the other hand, according to the same
estimate, there was a potential shortage of further 80,000
information security experts approximately in Japan.

Cybersecurity Strategy 55

Promotion and Implementationof Cybersecurity

6

Strategic

Headquarters

which will include the appropriate sharing ofcommandandcontrol

information with and providing essential advice

body to promote this strategy; and, as its

for organizations and business operators undersecretariat, the NISC takes a leading role toits jurisdictions.

promote cybersecurity policies set forth innational

this strategy. To this end, the NISC fulfills its

whole, coordination and collaboration will befunctions to implement required measuresenhanced among parties concerned, including

and to enhance governmental cybersecurity

active information sharing among industries,

capabilities. These include: the network-based

academia, and the public sector, in addition

vigilance and monitoring of malicious activities

to relevant governmental bodies. Particularly,

against information systems of administrative

to enable sensible response in the event oforgans; fact-finding on the cause of incidents

a cybersecurity incident, it is essential toand audit of relevant governmental bodies;enhance the governmental posture for incident

information gathering and analysis on domestic

readiness on a routine basis, to detect, analyze,

and foreign cybersecurity; the promotion ofand respond to cyber attacks and the like. In

international cooperation and collaboration;

this sense, the Government will strengthen

anddevelopment

its entire information gathering and analysis

for and by the governmental bodies. To fully

functions, including counter cyber intelligence

perform its responsibilities, the NISC will takefunctions as well as closer coordination andnecessary measures, including the further

collaboration with private entities, to expand

enhancement of its own response capabilities

daily information gathering activities and to

through the appointment of highly advanced

better foresee and detect threats in cyberspacecybersecurity experts from the private andpromptly.

other sectors, and so on; and the establishment

build and maintain a high-end posture withof frameworks for timely information sharing

sophisticatedwith relevant governmental bodies (including

analyzing, and sharing of information, whichthose of senior executives), to enable the NISC

enables immediate actions as an integrated

to obtain necessary information quickly and tocycle of prompt detection, analysis, decision-take appropriate whole-of-government actions

making, and response regarding cyber attacks.

in the case of a cybersecurity incident.

With

In close coordination and collaboration withmanagement function, the Government will

the NISC, each governmental body has thetake further enhancement measures, including

responsibility to perform its missions anda recommendation to be made by the Chief of

implement necessary cybersecurity measures,

the Cybersecurity Strategic Headquarters, while

The

Cybersecurity

functionsasthecybersecurity

56 Cybersecurity Strategy

workforce

Especially, to strengthen

cybersecurity

capabilities

asa

In addition, the Government will

regardfunctions

to

its

of

crisisthegathering,

responseandreviewing the modality and appropriateness ofStrategic Headquarters will collaborate andthe initial response posture and measures to beshare information with the crisis management

taken to a cyber attack or a similar incident. At

organs, including a headquarters for emergency

the same time, the Government will build an

response to terrorism, when established, andinter-organizational cooperation framework thattake appropriate actions concerning national

enables the governmental bodies, incorporated

security, in close coordination with the National

administrative agencies, cybersecurity business

Security Council.

operators, and other relevant stakeholders toMoreover, it is an upmost necessity for Japan

respond jointly to cyber incidents, such as ato work towards ensuring cybersecurity for

massive cyber attack.

The Government will

the major international events, including thealso make proactive efforts to promote close

Tokyo 2020. While making a clear recognition

coordination and cooperation among theseof cybersecurity risks and challenges relating

relevant parties, from industries and academia

to the Tokyo 2020, the Government willto the public sector, that have specific expertise

accelerate the formulation process of the CSIRT

in the areas of incident responses to massive

for the Tokyo 2020 as a core organ responsible

cyber attacks, practical training and exercisesforfor human resources development, and others.

detection and for information sharing among

These efforts include measures to: utilize thestakeholders vital to take appropriate measures

knowledge and experiences of relevant entities,

against cyber attacks on relevant entities

such as Information-Technology Promotion

involving the management and operation of

Agency, Japan (IPA) for monitoring of and fact-

the Tokyo 2020 and other associated businesses

finding on malicious activities in cyberspace andas well as those on the services provided

audit of governmental bodies being conductedby relevant CII.

by the Government; and utilize the technicalsteady actions with a phased approach to:knowledge and skills of relevant entities, suchbuild and maintain necessary organizations,as the National Institute of Information andfacilities, and cooperative relationships; ensure

Communications Technology (NICT), regarding

a pool of cybersecurity experts; and conduct

infrastructure for simulation exercises as wellcomprehensive preparatory training following

as monitoring and analysis for strengthening

the process taken for and during the 42nd G7

cybersecurity-related response capabilities. To

Summit in the Ise-Shima region in 2016 as wellrealize these policies, the Government will takeas the Rugby World Cup to be held in Japan

necessary measures, including legislative ones.

in 2019. Incident response capabilities to be

In recent years, there is an increase in highly

developed through these occasions will beadvancedutilized later for the sustainable enhancement

andwell-planned

cyberthat might be state-sponsored.

attacks

Countering

makingappropriate

prediction

andThe Government will takeof Japan's cybersecurity.

such cyber attacks is one of the most critical

Givenchallenges

management

cybersecurity policies to crisis management

The Cybersecurity

and national security, necessary resources,toJapan'sand national security.

crisisthegreatimportance

of

these

Cybersecurity Strategy 57

including additional funding, for the further
enhancement measures need to be ensured byseeking for the most appropriate reallocationand implementation of budget as a whole-ofgovernment approach, while efforts will bemade for maximizing administrative efficiency
and cost saving, and so on, through the review
of administrative works and policy measuresand by systems reforms. The Government will
also take immediate actions to maximum extent
feasible, including the appointment of highly
talented individuals as in-house cybersecurity
experts at the governmental bodies, by assuring
employment conditions that would suit the
professional values of their expertise. Where
additional procedures and regulations are
required, the Government will take actions as
appropriate and without delay.

58 Cybersecurity Strategy

7Plan Process and Review

Based on the current state of the nation as wellas the future scenarios for Japan's society inthe early 2020s, this strategy extracts criticalissues that Japan has faced, and outlines thebasic strategic directions over the coming three
years, for the resolution of these issues.

For

the steady implementation of the strategy, incompliance with the Basic Act on Cybersecurity,theCybersecurity

Strategic

Headquarters

will establish an annual plan for each fiscal
year during the triennium, and will produce
an annual report for the corresponding year,
by reviewing the status of progress in policy
implementation.
At the same time, the Cybersecurity Strategic
Headquarters

will

establishprioritization

policy

for

the

a

budgetgovernmental

bodies to implement cybersecurity measureseffectively in line with the directions thestrategy indicates.

Bearing in mind that thesituations and technical premises in cyberspace
are frequently evolving in an incoherent fashion,
the Government will undertake a functional
review flexibly, where necessary, regardless ofthe timeframe the three year plan covers.

Cybersecurity Strategy 59

Memo

60 Cybersecurity Strategy

The Government of Japan