Sustainability
Management

Society

Environment

Governance

External Evaluation
Performance Data

Guideline and all tax laws in the countries and regions in which it conducts business. It will not transfer created value tolower tax jurisdictions only to gain a tax advantage.
In addition, we disclose Group payments of taxes in our securities reports and other documents, as well as the reasonsfor any discrepancies from relevant statutory tax rates.
▶ Global Compliance Code▶ Sysmex Report (Operating Results and Financial Analysis)▶ Securities Report

Sustainability
Management

Society

Environment

Governance

External Evaluation
Performance Data

Governance▎ Risk Management Structure
Risk Management

Risk Management Structure

Promoting Risk Management by Establishing a Dedicated Committee
Sysmex established the Internal Control Committee to supervise risk management of the Group as a whole, andpromotes all risk management activities, including those regarding strategic risks. The Committee is chaired by theTax Strategy in the United Kingdom

President and its members include relevant executive officers and Audit and Supervisory Committee members (excluding▶ UK Tax Strategy（97KB）

outside members of the Managing Board, who act as observers).
By regularly assessing risks involved in such areas as fair trade, compliance (including corruption and business ethics),
human resources, occupational health and safety, the environment, and accounting and finance (including tax payments),

Respect for Intellectual Property

the Committee identifies risks significantly affecting the Group’s operations and takes necessary countermeasures. In

In the “Intellectual Property” Chapter of the Global Compliance Code, Sysmex stipulates that all the officers andaddition, it monitors the status of risk management by relevant committees, including the Compliance Committee, asproperty, and handle such intellectual property appropriately. We ensure that all the officers and employees are wellsignificant impact on the Group’s business arises, the Internal Control Committee also reports to the Managing Board toemployees of the Group must respect the intellectual property of third parties as much as the Group’s intellectualwell as individual divisions and subsidiaries, and periodically reports to the Managing Board. When a major risk that has ainformed of this rule and strictly comply with it. When developing new products, Intellectual Property, R&D, and Businessdiscuss how to respond, following the PDCA cycle.

Development Department members conduct and discuss global patent reviews for each new project.
▶ Global Compliance Code▶ Intellectual Property (Japanese)

Promotion of Security Trade Control
In the “Security Trade” Chapter of the Global Compliance Code, Sysmex stipulates that it will comply with the export

laws and regulations of individual countries and regions and will not be engaged in transactions likely to impede themaintenance of international peace and safety. Sysmex has established the Security Trade Control Committee, whichis under the direct control of the president, to prevent illegal exports. It has also assigned people at overseas regional
headquarters to oversee security trade control, bolstering our global operational structure. In addition, it provides annual
basic e-learning for all employees, as well as lectures on the latest world affairs and laws and regulations, as well as avariety of other types of training, to raise awareness of security trade control.
▶ Global Compliance Code▶ Corporate Governance▶ Sysmex Report (Risk Management)

8586

SustainabilityManagementSocietyEnvironment

Governance

External EvaluationPerformance Data

▎ Response to Risks Related to Business Continuity
Governance

Establishment of a Business Continuity Plan (BCP)

Response to Major Disasters

Sustainability
ManagementSociety

Environment

Governance

External Evaluation
Performance Data

▎ Enhancing Information Security
Governance

Enhancing Product Security and Cyber Security

Product Security Initiatives

Sysmex has formulated Group-wide business continuity plans (BCPs) for production, procurement, and other functions

Sysmex Corporation has established a Product Security Policy for our products and services and has establishedto ensure the continuity of important operations in the event of an earthquake, storm or ﬂood damage, and other large-

a Product Security Incident Response Team (PSIRT) to manage product design and manufacturing, as well as post-scale disasters, as well as rapid recovery from such disasters.
In addition, we relocated our distribution center to an inland location with less risk of ﬂooding so we can reinforce oursystem for stable supply even further. We also strengthened the facility with a quake-absorbing structure, private power
generation system, and ﬁre shutters.

marketing vulnerabilities. Sensitive information (including individual, patient, and test subject information) obtained fromour customers, and those who have participated in research and development and experiments, as well as advanced,original technology regarding products and intellectual property, are considered important assets for management, andnecessary measures are taken to prevent information leaks and internal fraud.

Information and Cyber Security Initiatives

Main BCP Approaches:
・Decentralization of main raw material procurement (selection of production locations based on theconcept of local production for local consumption)

・Establishment of a mechanism for procurement of parts such as semiconductors with long lead times toregister raw material ordering plans for such parts in a system based on our medium-term production plan・Decentralization of product storage according to storage function (instruments, maintenance parts, room

temperature storage reagents, cold storage reagents, and hazardous reagents)

・Creating mutual supply systems within the factories, and securing alternative routes for transportation ofproducts

・Prioritizing important products for supply to medical institutions

・Introduction of a tool (cloud system for disaster prevention information) to share crisis information

between the Company and raw material suppliers so the Company can promptly take measures against
highly urgent risks such as a natural disaster, ﬁre, or accident occurring on the supplier side

・Providing rules and manuals for disaster response and conducting regular disaster drills

We formulated the Information Security Policy to establish a Groupwide information security management framework. This creates an information security management system for the entire Group under the supervision andmanagement of a Member of the Management Board, a senior executive ofﬁcer,and a senior managing director, whoacts as Information Security Ofﬁcer, with the DX Strategy Development Division at its core. We established a Sysmex
Computer Security Incident Response Team (Sysmex-CSIRT) to bolster our initiatives such as prevention and early
response to incidents and pre- and post-response to information leaks and data breaches, based on such informationas alerts received from the managed SOC (security operations center) and threat information (threat intelligence)
received from external parties (JPCERT/CC).
Regarding collaboration with external organizations, we participate in the Medical Device Cyber Security Council,
whose members include representatives from the Ministry of Health, Labour and Welfare, hospitals, and domestic
medical device manufacturers. We have also joined the Nippon CSIRT Association and Forum of Incident Response andSecurity Teams (FIRST) to share information regarding threats from emergencies and other signiﬁcant incidents.
Internally, we have implemented speciﬁc measures including rigorous management and regular review of access toinformation, regular updates to security patches, login restrictions by biometric authentication (facial and ﬁngerprint
recognition) for laptop computers and mobile devices on loan from the Company, and reviews of installed applications.
In addition to these operational and control measures, we also installed endpoint detection and response (EDR) for PCs
and server devices as part of our ransomware countermeasures.

・Introduction of an employee safety conﬁrmation system
・Installation of digital radios in each business ofﬁce

・Provision of emergency supplies and items to support employees staying at business ofﬁces and returning

Information and Cyber Security Education

・Establishment of basic IT systems (assignment to an external data center and creation of a system

employees and independent contractors. In ﬁscal 2022, we held cyber security training in multiple languages for all

home after a disaster

infrastructure that is quickly transferable to a backup system in emergencies)

At Sysmex, we provide annual e-learning on information security for all our Group employees, as well as temporary
employees in the Group. We are also implementing initiatives to raise employee awareness of information security, suchas seminars concerning how emails should be handled, as well as drills for targeted email attacks (BEC and phishing).
We recommend that Sysmex-CSIRT members obtain international qualiﬁcations (ISC2 CISSP, SANS GIAC, CompTIA)▶ Undertaking the Never-Ending Mission of “ Creating a Stable Supply of Reagents”

to reinforce our response to security incidents.

Acquiring Information Security Certiﬁcation
Sysmex Corporation has obtained ISO 27001 certiﬁcation for our Information Security Management System (ISMS),
and we are enhancing our information security management for research involving gene sequencing and other personal
information. The service and support division of Sysmex CNA has obtained the same certiﬁcation. Sysmex UK andOxford Gene Technology have obtained Cyber Essentials ※ certiﬁcation as well as ISO 27001 certiﬁcation, and undergo asurveillance review every six months.
※ Certiﬁcation system initiated in 2014 by the UK government to improve corporate cyber security▶ Information Security Policy▶ Product Security Policy

8788