Introduction

GovernanceManagement

Social Innovation

Environmental

SocialGovernance

Assurance

Hitachi Sustainability Report 2023

155

Information Security

Corporate GovernanceBusiness Ethics and Compliance

Basic Concept

Risk Management

While advancements in digital technologies create new value, there is a growing risk of information leaks and shutdowns due to cyberattacks. These attacks become more sophisticated every

Information Security
Executive Summary

day and could interfere with business continuity. Risk management related to information security has become one of the most important issues for corporate entities. In response, Hitachi,
which aims to be a global leader through our Social Innovation Business, emphasizes cyber security measures from the perspectives of value creation and risk management.

Information Security
Governance DataTopic

Information
Security

Overview

Based on our information security policy, Hitachi pursues an optimal security structure under the supervision of our chief information security officer (CISO), confirming our sense of unity and agility as One Hitachi. Specifically, we work to prevent information leaks, conduct in-house information security education, and perform
internal audits related to information security.
To address risks associated with the diversification of cyberattack methods, we expanded the scope of security risk management and strive to reduce business risks

Cybersecurity

in the development and verification environment for creating products and services, production and manufacturing environments, supply chains, and product andservice development processes.

Data Protection

As a member of the global community, Hitachi commits to protecting personal information in accordance with a vision for personal information protection summarized as providing safety and trustworthiness, and recognizing the importance of individuals’ rights.Introduction

Management

Governance

Information Security

Corporate GovernanceApproach to Information Security

Social Innovation

Information Security
Executive Summary

Information Security
Governance Data

GovernanceSocialbased on this policy, and we address the challenges of infor-

Business Ethics and Compliance
Risk Management

Environmental

mation security management on an active basis.

Approach

The progress of digitization has brought new opportunities forcreating value, but this progress also amplifies the risks thatbusinesses face, including information leaks and operational
disruptions caused by increasingly sophisticated cyberattacks
that impede business continuity. To minimize these risks, risk
management related to information security has become oneof the most crucial challenges for companies. Against thisbackdrop, Hitachi, aiming to be a global leader in the Social
Innovation Business, is engaged actively in information security initiatives. We recognize cybersecurity measures as acrucial management challenge that addresses both value

Assurance

Hitachi Sustainability Report 2023

Framework for Promoting Information
Security
GRI 2-13/2-24/3-3

Structure

Information Security Policy
1. Formulating administrative rules for information security and ensuring their continual improvement
2. Protection and ongoing management of informationassets

156

The Chief Information Security Officer (CISO) has overall
responsibility and authority for implementing and operating
information security and personal information protection, andoversees information security for all Hitachi products, services,and internal facilities.

3. Legal and regulatory compliance

Chaired by the CISO, the Information Security Committee

4. Education and training
5. Preventing incidents and taking action when they occur
6. Ensuring business processes are optimized within
the corporate group

determines all policies and measures for information security
and personal information protection. These policies and measures are announced to all Business Units (BUs) and Group
companies through channels such as the Information Security

creation and risk management. Since Hitachi consists ofnumerous companies, we are pursuing our businesses as a
unified group, One Hitachi. In line with this business policy, weFramework for Promoting
Information Security
BU

address information security as One Hitachi, as well, striving
to establish optimal security measures and ensure a sense ofunity and agility. To this end, we accelerate the security measures based on common initiatives in accordance with theoverall Hitachi policy.

Hitachi, Ltd. HQ (Corporate)
BU

Group company
Hitachi, Ltd.

Group company

Group company

Group company

Group company
Group company

President & CEO

Chief Information Security Officer (CISO)

Information Security Audit Manager

Information Security Committee
Chairperson (and CISO)
Information Security Training Manager
Committee members: representatives of business sites andheads of HQ management divisions

Information Security Report

Information Security Officer
Audit Officer

Information Security Promotion Council

Information Security Policy
PolicyGRI 2-23

BUs/Businesssites

Information Security Officer
Information Security Manager
Data Protection Manager

Hitachi created an information security policy to protect infor-

Information Security Promotion Department

mation assets, including information entrusted to us by ourDepartment for the External Contact

customers, the systems that store that information, and theinformation systems that provide social infrastructure services.
We established various rules and implementation systems

Cybersecurity Manager
Information Systems Administrator
Information Asset Manager

Company president

Information Security Audit Manager

Introduction

GovernanceCorporate GovernanceManagement

Social Innovation

Promotion Council. BU and Business sites operate their own

Environmental

SocialGovernance

To prevent leaks from procurement partners, we review theirAssurance

Hitachi Sustainability Report 2023

157

protection and information security. Internal audits at Hitachi,

information security divisions, with the head of the BU or busi-

information security measures based on Hitachi’s own stan-Ltd. are conducted independently by audit managers

ness site serving as information security officers. These divi-dards before allowing them to access to confidential informa-appointed by the President and CEO. They are not allowed tosions implement information security management in eachtion. We also provide tools to procurement partners for security

audit their own units, which underlines our commitment toBusiness Ethics and Complianceworkplace and provide relevant education to employees. This

education and for checking business information on computers.

fairness and objectivity in auditing. The Group companies inRisk Management

framework is also implemented at Group companies to pro-In addition, we require procurement partners to check andJapan conduct internal audits equivalent to Hitachi, Ltd., andInformation Security

mote information security across the group through mutual

remove business information from personal computers.

all audit results are confirmed by Hitachi, Ltd.

Education on Information Security

common global self-check approach to ensure groupwide

Hitachi holds annual e-learning programs on information

inspections. All departments in Hitachi, Ltd. perform self-­

security and personal information protection for all executive

directed personal information protection and information

officers and employees. The participation rate in Hitachi, Ltd.

­security operation checks annually. In addition, departments

in fiscal 2022 was 100% (excluding those who could notinvolved in operations that handle important personal informa-Hitachi established a framework for information security

attend due to personal leave, etc.). Besides, Hitachi offers ation (739*1 related operations identified as of March 2023)

management based on the ISO/IEC 27001 internationalvariety of programs depending on the target and aims, such

perform personal information protection operation checks

standard. We enhance information security by ensuring

as those for new employees, new managers, and lectures forevery month. Through these measures, we check operational

information security response measures comply with theinformation system administrators. Hitachi also implements

status regarding personal information regularly.

United States government standard SP800-171. The

simulation training to educate employees about phishing

Information Security Rules and the Personal Information

attacks and other cyberattacks. Employees receive deceptivetion activities through regular on-site assessments of theProtection Rules including Information Security Standards

e-mails as phishing simulations to heighten their awareness ofstatus of information security measures. A team of in-houseare communicated globally by Hitachi, Ltd. and Group com-security through direct experience.

security specialists is responsible for identifying any deviations

Executive Summary

cooperation.

Information Security
Governance Data

Information Security ManagementActivities

Hitachi requires Group companies outside Japan to use aHitachi is also engaged in groupwide security risk reduc-panies headquarters. Hitachi also makes use of shared

Training programs in Hitachi, Ltd. are shared with thesecurity services and related information security support

Group companies in order to actively implement training on

companies in Japan contract with an external organization toprovided by regional headquarters in the Americas, Europe,

information security and personal information protection in theconduct quarterly external vulnerability assessments of serv-

Southeast Asia, China, and India.

entire group.

ers open to the public and other external vulnerabilities.

Preventing Information Leaks
Hitachi engages in a number of IT-related measures such as

Information Security Management Evaluation andMonitoring

device encryption, secure PC use, electronic document

Hitachi implements information security and privacy protectionaccess control and expiration processing software, ID man-initiatives based on the PDCA cycle of the information security

agement and access control via authentication infrastructure,management systems stipulated by Hitachi, Ltd. We conduct

e-mail and website filtering, etc. to prevent information leaks.

regular audits and inspections to monitor and evaluate whether

In response to the recent proliferation of targeted e-mailmanagement and measures for information security and dataattacks and other cyberattacks, we not only participate in anprotection are implemented properly in each department.

initiative to share information between the private sector andAll divisions of Hitachi, Ltd. and Group companies inthe government, but also strengthen various IT measures thatJapan conduct annual internal audits of personal information

include defense-in-depth strategy.
Note: Hitachi normally refers to suppliers (including suppliers, vendors or providers) as procurement partners who build business together on an equal footing.

arising from self-checks. Further, Hitachi, Ltd. and GroupIntroduction

GovernanceManagement

Social Innovation

Environmental

SocialGovernance

Cyber-Security Initiatives

Hitachi Sustainability Report 2023

158

Data Protection Initiatives

Activities

Corporate Governance

Assurance

Activities

GRI 418-1To address the risks posed by the increasing diversification ofCyber-Security Monitoring

As digital technology continues to advance, the global trend

Business Ethics and Compliancecyber-attack methods, origins, and impacts, Hitachi is expand-

The Hitachi Security Operation Center (SOC) monitors security

toward leveraging data only accelerates. This situation has led

Risk Management

ing the scope of our security risk management. Traditionally,on an around-the-clock basis to ensure global-scale cyberat-

to heightened interest in the protection of personal information

Information Security

we focused risk management on response measures for inter-tacks are detected and response measures initiated immedi-and cross-border data exchange. In such an environment,

nal IT environments. To reduce business risks going forward,

ately. The Incident Response Team (IRT) collects and develops

Hitachi places significant importance on personal information

we will include the development and verification environments

threat information and manages our response to any security

protection initiatives to ensure the secure management ofused to create products and services, production and manu-incidents.

personal information received from customers and personal

Executive Summary

Information Security
Governance Datafacturing environments, and the supply chain and product/
service development process.

Cyber-attack methods are becoming more sophisticatedinformation involved in business operations. As a member ofevery year, with an increasing number slipping past detection

the global community, Hitachi is committed to protecting

systems. More often, these attacks tend to go undetected for

personal information in accordance with our vision for per-Cyber-Security Management

long periods, resulting in increased damage. In this context,

sonal information protection, which is to provide safety andHitachi established standards for internal IT environment-­

Hitachi strengthens cyber surveillance through Endpoint

trustworthiness, and to value individual rights.

related vulnerability response measures and network security.

Detection and Response (EDR)* to monitor device behavior

We also require BUs/Group companies to conduct regularand perform authentication protection. We continue to

Personal Information Protection

status assessments of these measures and perform corrective

improve and strengthen our cyber monitoring environment

Hitachi, Ltd. established the Personal Information Protectionactions. As a companywide measure, we launched an initia-using the latest technology.

Policy which is announced to all executive officers andtive to monitor vulnerability mitigation for each device andfollow up with users/administrators to expand the application

1*1 Systems to monitor suspicious behavior and respond quickly to attacks on
endpoint devices such as computers.

of such measures.
In the development/test and production/manufacturing

employees, and is also publicly available. Hitachi created apersonal information protection management system basedon this policy. This system ensures the protection of personal
information by such means as appropriate management ofenvironments, we established standards and guidelines forpersonal information, educational programs for all employees,

infrastructure construction and operations to ensure security

and periodic audits. We do not share personal information

compliance in each environment, and we pursue measureswith third parties without data subject’s prior consent. Even in

based on these guidelines within the Hitachi Group. We also

cases where prior consent is obtained, Hitachi requires theshare information security requirement standards establishedthird party to whom the data is provided to comply withby Hitachi with our procurement partners, working coopera-

Hitachi’s Personal Information Protection Policy.

tively to enhance security.

Hitachi also strives to safeguard personal information

We established management guidelines to address andglobally based on each company’s personal information pro-

maintain the security of products and services, and we follow

tection policy, and we ensure that these companies comply

measures based on these guidelines within the Hitachi Group.

with all applicable laws and regulations in each country andregion, as well as to the expectations of society at large.
Personal Information Protection Policy of Hitachi, Ltd.
https://www.hitachi.com/privacy-e/Note: Hitachi normally refers to suppliers (including suppliers, vendors or providers) as procurement partners who build business together on an equal footing.

Introduction

GovernanceCorporate GovernanceManagement

Social Innovation

PrivacyMark Certification

Environmental

SocialGovernance

Hitachi, Ltd. obtained PrivacyMark*1 certification, which is a

Responding to Personal Data Protection Laws
Around the World

third-party certification of personal information protection.

With the increasing risk of privacy violations, lawmakers areAssurance

Hitachi Sustainability Report 2023

159

Third-Party Evaluations and CertificationsActivities

The entire Hitachi Group is committed to personal information

actively seeking to create and modify relevant laws and legis-

Hitachi encourages the acquisition of third-party evaluations

Business Ethics and Compliance

protection, and 37 Hitachi Group companies in Japan havelation in countries and regions around the world. Hitachi

and certifications for information security management. OurRisk Management

been granted the PrivacyMark as of the end of July 2023.

ensures thorough global compliance with legal frameworks,

data centers and other divisions obtain certification from thecontinues to monitor related legal frameworks and social

ISMS Accreditation Center (ISMS-AC) in accordance with thetrends, and implements appropriate measures.

ISO/IEC 27001 Information Security Management System

Information Security
Executive Summary

Information Security*1 PrivacyMark: A third-party certification that is granted by the assessment bodythe Japan Information Processing Development Corporation to businesses thathave taken appropriate security management and protection measures relatedto personal information (invested by Japan Information Processing
Development Corporation).

In Japan, Hitachi complies with the Amended Act on theinternational standard. Eight divisions have received thisProtection of Personal Information, and in the event that a­certification at Hitachi, Ltd., and 28 divisions representing 23

leak may result in a situation that would harm the rights andGroup companies*1 have also received this certification.

Privacy Protection Initiatives

interests of individuals, Hitachi promptly report said leak to the*1 As of the end of June 2023

In response to social demands for privacy protection mea-Personal Information Protection Commission and notify thesures, Hitachi, Ltd. aims to provide more appropriate andaffected individuals. We recorded one case of personal infor-

high-quality services and products, and foster trust with con-mation leakage at Hitachi, Ltd. during fiscal 2022. We identi-

sumers and other stakeholders, by balancing privacy protec-

fied the scope of the impact related to this incident and tooktion and the use of personal data.

appropriate action.

Governance Data

In 2014, we established the position of personal data

Hitachi also formulated a groupwide internal code of con-officer to oversee personal data handling in Digital Systems &duct concerning the protection of privacy, which takes intoServices, which drives our digital business. We also estab-consideration international legal frameworks such as thelished the Privacy Protection Advisory Committee to consoli-

European General Data Protection Regulation (GDPR). Thisdate our knowledge on privacy protection, support risk

code of conduct became effective as of April 2022. Moreover,assessments, and consider response measures.

individuals responsible for personal data protection areFurther, we began companywide effort by adopting theHitachi Privacy Impact Assessment (PIA) in 2023.
Through these initiatives, we structure measures to prevent issues related to privacy, implementing privacy impact
assessments for operations that involve personal data handled by employees.

appointed in each Group company, and s­ upport functions forregional group companies have been established within eachregional headquarters. In this way, we ensure consistent personal information protection on a global scale.