Summary of the Japan‘s Cybersecurity Strategy (July 27, 2018 Cabinet Decision)

New Cybersecurity Strategy is the second ”basic plan for Cybersecurity” under the Basic Act of Cybersecurity. Far-seeing 2020, the Strategy shows
basic position and vision on Cybersecurity, and objectives and implementation policies in next 3 years (2018~2021) domestically and internationally.

1 Introduction
2 Understanding on
Cyberspace••

A paradigm shift brought about by cyberspace which no human have experienced before（Society5.0）
Increasing seriousness of threats with cyberspace and real space unification, necessity of new strategy far-seeing theTokyo 2020 Games•

Knowledge, technologies, and services in cyberspace, such as Artificial Intelligence (AI) and Internet of Things (IoT) arebecoming adopted in society and bring about abundance for humanity.
There is always the latent risk that the providers of these technologies will lose the ability to control them. Attacks
directed at IoT, critical infrastructure, supply chains, as well as incidents suspected to have been state-sponsored will
increase socio-economic losses exponentially.

••

Visions and Objective
４3目的達成のための施策
of this Strategy•

Adherence to the Basic Position on Cybersecurity (Objectives of the Basic Act on Cybersecurity; Basic Ideals (“free, fairand secure cyberspace”); Basic Principles）
Basic Vision of Cybersecurity as a Goal: Cybersecurity for sustainable development (Promotion of “Cybersecurity
Ecosystem”); Three Approaches (1. Mission Assurance for service providers; 2. Risk Management; 3. Participation,
Cooperation and Collaboration)

4 Policy Approaches towards Achieving the Objective
Building a Safe and Secure Society
for the People

Enabling Socio-Economic Vitality
and Sustainable Development～Advancing Cybersecurity as Value Creation Driver～

Advancing Cybersecurity as Value
Creation DriverAchieving a Supply Chain that
Creates Values through Diverse
Connections
Building Secure IoT Systems

Contribution to the Peace and Stabilityof the Int’l Community and Japan’s
National Security～Mission assurance for protecting people and society～
Measures for the Protection of People and Society
Protection of Critical Infrastructure through Publicand Private Sector Cooperation
Strengthening and Improving Security in
Governmental Bodies and Government-Related
Entities
Ensuring a Safe and Secure Educational andResearch Environment at Universities etc.
Initiatives for the Tokyo 2020 Games and Beyond
Building an Information Sharing/Collaboration
Framework that Extends beyond Traditional
Frameworks
Strengthening the Incident Readiness Against
Massive Cyberattacks～Commitment to a Free, Fair andSecure Cyberspace～

Commitment to a Free, Fair andSecure Cyberspace
Strengthening Capabilities for
Defense, Deterrence, and Situational
Awareness
International Cooperation and
Collaboration

Cross-cutting Approaches to Cybersecurity
Development and Assurance ofCybersecurity Human Resource

5 Promotion and
Implementationof Cybersecurity

Advancement of Researchand Development

Cooperation by Everyone who is
the Main Player in Cybersecurity

The related government bodies will keep working on improving their cybersecurity capabilities under the leadership of National centerof Incident readiness and Strategy for Cybersecurity(NISC), and NISC will play its leading role as the focal point in coordinating intragovernment collaboration and promoting partnerships between industry, academia, and the public and private sectors.
1Points of 【１．Introduction】 & 【２．Understanding on Cyberspace】

The Current Understanding and the Future Image(Increasing Seriousness of Threats with Cyberspace and Real Space Unification)

２：サイバー空間に係る認識
Shift from as of Formulating
Current Strategy (Sept. 2015) to Present[(As of formulating the strategy2015) Emergence ofInterconnected and Converged Information Society][Unification of Cyberspace and Real Space]- People and things in real space have become
interconnected to the network, and cyberspace andreal space have become highly integrated. -Real Space (Physical Space)

Real Space (Physical Space)(Utilization of Social
Security and Tax
Number System)

Smartphone

VehicleAppliance

・・・・・

Interconnected/
Converged

Unification

Medium and Long Term

Cyberspace

Interconnected/
Converged

E-Gov.

Infrastructure(Smart City)

Cyberspace
Manufacturing(Data
Utilization)

Finance(Connected
Industries)

Robot

Healthcare/
Caregiving(FinTech)Transport(Self-driving
automobiles)

Understanding on Cyberspace
・While knowledge, technologies, and services in cyberspace, such as AI, IoT, Fintech, robotics, 3D printers, and AR/VR, arebecoming established in society and leading innovations that are transforming the existing structures in socio-economic
activities and the daily lives of Japanese people, there are always the latent uncertainties.

Benefits of Cyberspace

Increasing Threats in Cyberspace- Technologies and services in cyberspace are controlled
and gaining routine use in numerous domains. Theybring about abundance for humanity.
- The evolution of AI based on deep learning is bringing
about changes, it is beginning to be adopted in a wide
range of industries.
- New businesses and services are being created to utilize
the data obtained from IoT devices.

- There is always the latent risk that the providers oftechnologies and services in cyberspace will lose the ability tocontrol them, in which case they can cause immeasurable
economic and social loss or damage.
- Society will be significantly affected when interruptions
occur to numerous businesses, functions, and services dueto the interruption of important infrastructural services orunintended behavior by IoT devices, and situations could evendevelop to the point of becoming national security issues.
- Inadequacies in cybersecurity measures are predicted to directly
cause and expand financial damages and losses.

2Points of 【３．Visions and Objectives of This Strategy】

Basic Vision and Approaches for Cybersecurity(Cybersecurity for Sustainable Development –Promotion of “Cybersecurity Ecosystem”-)○ Japan will aims for sustainable development of cyberspace(Realizing “Cybersecurity Ecosystem”) to realize a society(Society5.0*) where
new values and services are generated continuously, bringing abundance to the people.
○ Japan will adhere to its basic position on cybersecurity presented in the Strategy 2015 and promote public and private sector initiatives
on cybersecurity based on three approaches (1. mission assurance for service providers; 2. risk management; and 3. participation,
coordination and collaboration).
* The fifth society in human history following hunting, agriculture, industry and information. New value or service emerge
one after another and generate wealth to subjective people of the society (from Future Investment Strategy 2017)

1. Mission
Assurance＜Basic Vision of Cybersecurity＞

Reliable Execution of
Operations & Services- Understand the operations or services that should be carried out as “missions,” and ensure capabilities andresources* to execute such “missions.”- Each organization should proactively work towards securing cybersecurity to conduct its “missions,”
without just relying on some experts.
* Including human resource, equipment,
facilities, network, information systems,
infrastructure and supply chain

Cybersecurity for Sustainable Development–Realizing “Cybersecurity Ecosystem”The image of cyberspace evolving
through autonomous initiatives of

2.RiskManagement
Assessment of Uncertainty& Appropriate Response

all stakeholders mutually impacting
each other will be called the“Cybersecurity Ecosystem” ascompared to a type of ecosystemthat develops sustainably.
-- Minimizing risks to an acceptable level by identifying,
analyzing, and evaluating them associated with
“missions” assigned to organizations.

-3. Participation,
Coordination,andCollaboration(New Cyber Hygiene)
Measures, Coordination &Cooperation by Individuals &Organization from Peacetime

Fundamental initiatives implemented by individuals ororganizations from peacetime to prevent damages or its
escalation possibly caused by threats in cyberspace.
Sharing information and mutually coordination and collaboration
between each other regardless of peacetime or emergency
situations should be regarded as new cyber hygiene.

3【４．Policy Approaches towards Achieving the Objective】

Points of Enabling Socio-Economic Vitality and Sustainable Development

Enabling Socio-Economic Vitality and Sustainable Development
・It is necessary in all industrial sectors that consistent cybersecurity measures are carried out to ensurecorporate business continuity and create new value. In doing so, it is important for the companies toimplement the measures for which should be handled as part of risk management.

１．Advancing Cybersecurity as Value Creation Driver
Raising executive awareness (from “cost” to “investment”)
Promote companies to actively disseminate and disclose
information regarding their cybersecurity initiatives
Promoting the use of insurance in cybersecurity incooperation with private sectors

Risk management by executives
Utilize advanced technology

Security by design

Preparing guidelines to support the challenges towards newvalue creation, risk analysis, and research & development

２．Achieving a Supply Chain that Creates
Values through Diverse Connections
Clarifying threats in the supply chain and formulating
as well as disseminate frameworks that cut acrossindustrial categories for implementing operational-levelmeasures
Offering specific measures of each sector
Promoting initiatives by small and medium-sizedenterprises

３．Building Secure IoT Systems

IoT

AI

VR

Block
chain

5G

Countermeasures for supply chain

Framework for consideringrisk and measures
System for ensuring thecontinuous trustworthiness

Improving structural
framework andinternational standard
Countermeasuresfor vulnerabilities

Enhancing cybersecurity business supporting
innovation utilizing advanced technologies

Improving structural framework for IoT systems andinternational standard
Establishing models regarding measures for vulnerable IoT
devices and expanding them overseas through international
coordination and standardization

Business continuity

Value creation
4【４．Policy Approaches towards Achieving the Objective】 Points of Building a Safe and Secure Society for the People

Mission Assurance for Protecting People and Society
For the realization of society in which the people can live safely and securely, it is important to ensure multi-layered cybersecurity, through thecoordination of multi-stakeholders, including governmental bodies, local governments, cyber-related enterprises, critical infrastructure operators,
educational and research institutions, and every people themselves. The government will promote initiatives based on the “mission assurance”
approach in order to reduce risks to an acceptable level and ensure that these operations and services are provided safely and continuously.

１．Measures for the Protection of the People and Society
Promoting the policy of “Proactive Cyber Defense ”(Promoting the sharing and utilization of threat information,
Providing information of vulnerabilities)
Smooth implementationof the Tokyo2020

Enhancing measures against cybercrimes

２．Protection of Critical Infrastructure through Public andPrivate Sector Cooperation
Promoting initiatives based on the Cybersecurity Policy for Critical
Infrastructure Protection
Strengthening security in local governments

３．Strengthening and Improving Security in
Governmental Bodies and Government-Related Entities

Building a Safe and Secure Society for the People

Mission Assurance（to provide criticalinfrastructure services safely and continuously）

Managing the state of information systems in real-time(Measures based on new common standards)

４．Ensuring a Safe and Secure Educational and Research
Environment at Universities etc.
Implementing practice for each level, and practical training andexercises

Information Sharing/
Collaboration（Cybersecurity Council, Cyber Security Incident
Response Coordination Center）

５．Initiatives for the Tokyo 2020 Games and Beyond
Promoting the development of the Cyber Security
Incident Response Coordination Center

Gobvernmental

６．Building an Information Sharing/Collaboration
bodiesFramework that Extends beyond Traditional Frameworks
Promoting information sharing/collaboration between
multi-stakeholders

７．Strengthening the Incident Readiness Against
Massive Cyberattacks
Strengthening the incident readiness against
massive cyberattacks in order to work on risk
management for both cyberspace and real space

Promoting risk
management

Local
governments

Critical Infrastructure
operators

Improvement andPromotion of the
Safety Principles

Conducting
exercises andtraining

Cyber-Related
Enterprises

Educational andResearch
Institutions

Developmentof Cybersecurity
human resource

Collecting andanalyzing
Information

5【４．Policy Approaches towards Achieving the Objective】 Points of Contribution to the Peace and Stability of the International Community and National Security

Commitment to a Free, Fair, and Secure Cyberspace
A free, fair, and secure cyberspace is essential to contribute to the peace and stability of the international community and to Japan’snational security. In order to safeguard a free, fair, and secure cyberspace, Japan will communicate its position in the international fora,
ensure international security and promote international collaboration.

１．Commitment to a Free, Fair, and Secure Cyberspace
Communicating the ideas of a free, fair and secure
cyberspace(Communicating basic approach to cybersecurity, Thwart any efforts
that aim to inhibit the development of cyberspace)

Communicating
the ideas of a free,fair and secure
cyberspace

Promoting the rule of law in cyberspace(Application of existing international law to cyberspace, Contribution
to the development and universalization of norms)

２．Strengthening Capabilities for
Defense, Deterrence, and Situational
Awareness

Cooperating
for Capacity
Building

Promotingthe rule oflaw incyberspace

Ensuring national resilience(Mission assurance, Defending Japan’s advanced technologies anddefense related technologies)

Enhancing deterrence capabilities(Measures for effective deterrence, Confidence building measures)

Strengthening cyber situational awareness(Increasing the capabilities of relevant governmental bodies, Threat
information sharing)

３．International Cooperation
and Collaboration

Strengthening
Capabilities for Defense,
Deterrence, andSituational AwarenessInformation
Sharing / Quick
response of theincidents

Sharing
Expertise
andCoordinating
PolicySharing expertise and coordinating policy
International collaboration for incident response
Cooperating for capacity building6【４．Policy Approaches towards Achieving the Objective】 Points of Cross-cutting Approaches to Cybersecurity

Promoting Measures the Cross-cutting Approaches to Cybersecurity
It is important to work on human resource development and research and development as a foundation for the policy goals from both across-cutting and mid- and long-term perspective. Simultaneously, it is also crucial to promote a cooperative approach in which
everyone plays a role in working on cybersecurity as an active agent in cyberspace.

1. Development and Assurance ofCybersecurity Human Resource
Training and adoption at the “strategic managementlevel”
Training for the operational and expert level
Preparing a foundation for development of cybersecurity
human resource, Promoting international partnership
Strengthening the assurance and development ofcybersecurity human resource at agencies

2. Advancement of Research andDevelopment
Promoting practical R&D (Increasing ability to detectand analyze cyberattacks, and developing a system forcarrying out the necessary technical inspections ofmalicious programs)
Responses with a view to the mid- and long-term
evolution of technology and society

3. Collaboration by Everyone who is
the Main Player in Cybersecurity
Developing action plan for public awareness on
cybersecurity and coordination/collaboration
Disseminating necessary information (enhancing
Cybersecurity Awareness Month)

SeniorExecutives

Strengthen
training

Establishingroles

Raising AwarenessManagement
strategy

Strategic Management
Level

Utilization
Direction

ReportCoordination

The core support for risk management
regarding business continuity and value
creation

ReportCoordination

Operational andExpert Level
Considering and implementing themeasuresPreparing a Foundation for Development ofCybersecurity Human Resource■Concerns for security of
products and services■Explaining to users

Industry

Government■Building a system that enables
stakeholders to collaborate andcooperate■Disseminating necessary
information■Cybersecurity Awareness Month

Collaboration
Cooperation■Information moral
education

Schools

Community■Autonomous activities

Cultivating awareness and understanding ofcybersecurity for each and every people7【５．Promotion and Implementation of Cybersecurity 】

Implementation Framework○The Government has been promoting a policy of improving cybersecurity measures to secure the use and application of information and communications
technologies and data as the socio-economic foundation of society and to ensure Japan’s national security. the related government bodies will keep working on
improving their cybersecurity capabilities under the leadership of NISC, secretariat of the Cybersecurity Strategy Headquarters, and NISC will play its leading role as
the focal point in coordinating intra-government collaboration and promoting partnerships between industry, academia, and the public and private sectors.
○ The Headquarter will seek to secure and execute the budget necessary for the government so that the measures are steadily and effectively executed. The
Cybersecurity Strategic Headquarters will set forth annual plans including the list of Agencies in charge.

サイバーセキュリティ政策の推進体制 Cabinet

Prime Minister

Competent Ministriesof Critical Infrastructures

CriticalInfrastructure
Expert Panel・Financial Services Agency
・Ministry of Internal Affairs andCommunications
・Ministry of Health, Labour and Welfare
・Ministry of Economy, Trade and Industry
・Ministry of Land, Infra, Transport andTourism

Critical infrastructurebusinesses, etc.

Human Resources
Expert Panel for
Dissemination andEnlightenment

National Center of Incident Readinessand Strategy for Cybersecurity (NISC)
・Director-General
GSOC

・Deputy Director-General
CYMAT

Government organizations (Ministries, IAAs,
Designated Special Corporations)

NSC deliberates onimportant issues
regarding national
defense.

Cybersecurity
Measures
Promotioncommittee

Ministries under HQMembers

Cooperation

・Ministry of Education, Culture, Sports,
Science and Technology (Security
education)

Technological
Strategy
Expert Panel

Secretariat
Cooperation

Relevant Ministries

Chair: Chief Cabinet Secretary
Deputy Chair: Minister in charge of the Tokyo Olympic andParalympic Games
Members:
Chairman of the National Public Safety Commission
Minister for Internal Affairs and Communications
Minister for Foreign Affairs
Minister of Economy, Trade and Industry
Minister of Defense
Minister in charge of Information Technology Policy
Experts (7 persons)

Cooperation

IT Strategic Headquarters
swiftly and thoroughly
introduces the measures forthe formation of an advanced
information andtelecommunications network
society.

National Security
Council (NSC)

Cybersecurity Strategic Headquarters
Cooperation

IT Strategic
Headquarters

・National Police Agency
・Ministry of Internal Affairs andCommunications
・Ministry of Foreign Affairs
・Ministry of Economy, Trade andIndustry
・Ministry of Defense

Companies

Individuals
8