September 2018

A cyber-risk estimation model to discuss in board of directors meetings- Quantifying Cyber Risk Survey [Outline] Close to ¥63 trillion, nearly 0.8% of global GDP, was lost due to cybercrime in 2017, which isup from the CSIS and McAfee 2014 survey that put global losses at around ¥47 trillion 1. For its
part, the economic impact of cybercrime in Japan is estimated at around ¥1 trillion.
 According to our survey, the stock value index of 18 companies declined by an average of 10%
from the day on which a data breach was disclosed, and the companies experienced anaverage decrease of 21% in net profit. Furthermore, there are many cases in which Japanesecompanies have faced a massive amount of direct financial loss and their CEOs gave up theirsalaries for several months to take responsibility.
Net profit after data breach disclosure (n=16)

Stock value index after data breach disclosure (n=18)
105%

Net profit
100%

100%

95%

21%
DOWN

100%

79%

94%

90%

10% DOWN

90%
85%

85%

80%
-10
DAYs
基準値-5 D
-5日後

0D
0日後

5D
5日後

10 D
10日後

18社平均
Average15 D
15日後

20 D
20日後

東証一部
1st Section

25 D
25日後

30 D
30日後

35 D
35日後

40 D
40日後

45 D
45日後

50 D
50日後

0%
Previous Year

東証一部以外の上場企業
Other than 1st Section

Disclosure Year Unlike overseas companies, the majority of Japanese companies havenʼt discussed cyber risks
in board of directors meetings. From the twin aspects of the responsibilities of board ofdirectors and the rise of cyber risks, Japanese companies should discuss cyber risks as part oftheir corporate governance.
 The Japanese government should encourage and support an increased awareness of cyberrisks by directors and managements of companies, as a critical issue to protect the progress ofJapan's growth strategy.
What Japan should do to address cyber risks in board of directors meetings.
1. Add a cyber-risk item to Japan's Corporate Governance CodeFSA, METI and the Japan Exchange Group should cooperate to add cyber-risk items toJapan's Corporate Governance Code.
2. Cyber-risk estimation model
A cyber-risk estimation model (see Page 4) is needed to aid understanding of the business
impact of cyber risks for directors and managements who are not familiar with information
technologies.
3. Increase awareness and develop training programs for directors and managements
An awareness program and a management training program are needed to help directors
and managements understand cyber risks properly.
1“Economic Impact of Cybercrime (2018)” https://www.mcafee.com/enterprise/ja-jp/about/newsroom/press-releases/press-release.html?news_id=2018030801

Page 1

1.

Why are cyber risks a management issue?

When cybersecurity is discussed within an organization, the tendency is for matters to be
discussed from a technical point of view, such as new vulnerabilities being discovered or the factthat the number of new cyberattacks is increasing. However, directors and the managements ofcompanies are more likely to be concerned with the potential financial impact and their
responsibilities rather than with technical trends. Japanese companies should quantify their cyberrisks, which is a common language of management, to aid understanding among executives who
are not familiar with information technologies.
According to a JCIC survey, the stock value index of 18 companies declined by an average of
10% from the day on which a data breach was disclosed (see Figure 1). As the stock value index
for other than the first section of the Tokyo Stock Exchange declined by an average of 15%, thesurvey made it clear that the impact of a data breach on small to midsize companies was greaterthan for large enterprises. This is because small to midsize companies depend on a single
business model and the impact of cyber risk affects their business directly.
(Figure 1) Stock value index after data breach disclosure (n=18) (JCIC survey)
105%

100%

95%

94%

90%

10% DOWN

90%
85%

85%80%-10DAYs
基準値

-5 D
-5日後

0D
0日後

5D
5日後

10 D
10日後

18社平均
Average

15 D
15日後

20 D
20日後

東証一部
1st Section

25 D
25日後

30 D
30日後

35 D
35日後

40 D
40日後

45 D
45日後

50 D
50日後

東証一部以外の上場企業
Other than 1st Section

Moreover, 16 companies that disclosed data breaches experienced an average decrease in net
profit of 21%. The reason for such a large decrease in net profit was an extraordinary loss forincident response, investigation, and additional security measures.
(Figure 2) Annual revenue and net profit after data breach disclosure (n=16) (JCIC survey)

Annual revenue
100%100%

Net profit
100%

104%

100%

21%
DOWN
79%

0%

0%
Previous Year

Disclosure Year

Page 2Previous Year

Disclosure Year

Thus it can be clearly seen that cyber risks lead to a decline in stock price and net profit.
Furthermore, there are many cases in which Japanese companies have faced a massive amountof direct financial loss and their CEOs have given up their salaries for several months to takeresponsibility. The impact of cyber risks is so huge that cybersecurity is no longer just an IT
department matter, but one of the top priorities for management.

2.

Why haven't Japanese organizations discussed cybersecurity in board of directors meetings?

In order to enhance Japan's corporate governance, an amendment to the Companies Act waspromulgated in May 2015. The amendment was enacted to encourage the supervisory function ofboards of directors. Because cyber risks are one of the top priorities for management, more thanhalf of global companies discuss cybersecurity in board of directors meetings. However, only 18%of Japanese organization said board of directors meetings should discuss cyber risks, comparedwith 56% of global organizations (see Figure 3).
(Figure 3) Question: Should boards of directors discuss cyber risks?
Strongly Agree56%

GlobalJapan

Strongly Agree
18%

There are three reasons why Japanese organizations don't discuss cyber risks in board ofdirectors meetings (see Figure 4). 1) There are no regulations or guidelines for doing so from thecorporate governance point of view; 2) There are no indicators that directors can easily
understand the cyber risk; and 3) Low awareness among directors, auditors, investors andmanagement. Below are solutions for each issue.
1) FSA, METI and the Japan Exchange Group should cooperate to add cyber-risk items to theJapan's Corporate Governance Code. Since the Code has just been revised in June 2018, METIshould add cyber-risk items to the CGS (Corporate Governance Systems) guidelines as a firststep. In addition, it would also prove effective to amend the importance of the responsibilities
of boards of directors in the Cybersecurity Management Guidelines.
2) A cyber-risk estimation model is needed to aid understanding of the business impact of cyberrisks for directors and managements who are not familiar with information technologies.
3) Encouraging an increased awareness of cyber risks is also important. An awareness programand a management training program are needed to help directors and managements
understand cyber risks properly. To maintain quality of the program, the issuance ofcertificates for the training program and lectures should be considered.

Page 3(Figure 4) Recommended solutions to raise awareness of directors
IssuesRecommended Solutions

1) No regulations or guidelines

Add a cyber-risk item to Japan's Corporate

from the corporate governance

Governance Code, CGS guidelines, Cybersecurity

point of view

Management Guidelines and more.
A cyber-risk estimation model is needed to aid2) No indicator that directors canunderstanding of the business impact of cyber risks foreasily understand cyber risks

directors and managements who are not familiar withinformation technologies.

3) Low awareness among
directors, auditors, investors andmanagements

Raise awareness and develop a training programfor directors, auditors, investors and managements.

Page 4

3.

Cyber-risk estimation model

An example of a cyber-risk estimation model is shown below (Figures 5 and 6). The diagramshows an illustration of a company with annual revenue of ¥100 billion. The purpose of the modelis for submission to board of directors meetings to encourage discussion among directors andmanagements.
(Figure 5) Probable maximum loss (An example of a company with an annual revenue of ¥100 billion)
Probable
Maximum Loss

Note

Calculated by JO Model (JNSA)

Direct Loss
Indirect Loss

①Loss of Personal
Identified Information
Leakage- ¥8 B

②Loss of BusinessDowntime

5 Days- ¥2 B

Calculated by internal interview③Fines and Penalties
by Violation of Law- ¥4 B

Example of fines of EU-GDPR④Incident ResponseFee- ¥60 M

Calculated by prior incident or interview⑤Loss of Net Profit- ¥1 B

Calculated by JCIC survey⑥Loss of Market
Capitalization- ¥30 B

Calculated by JCIC survey

Value of Basic Information X Degree of Information Sensitivity X Degreeof Ease in Identifying X Degree of Social Responsibility X Appraisal ofPost-Incident Response X Number of Leakage(production per day X product unit price) +(online sales per a day)

4% of annual global turnover or €20 M (whichever is greater)

Investigation Cost + Recovery Cost +Prevention Cost and more

Last Fiscal Year’s Net Profit X 21%

Market Capitalization X 10%(Figure 6) Benchmark and Investment⑦Benchmark Results⑧The total investment
to meet industry's
ideal level

Deviation Value

42.7

5 years total¥1.3 B

Our organization faces high risk, as a result ofindustry benchmark.
To achieve deviation value of 50, our organizationneeds the following investment.
Initial : ¥300 M
Running : ¥200 M X 5 years

Score

76 / 135 points(Deviation Value 42.7)

Industry Ideal Level

107 / 135 points

Industry Average

84 / 135 points

Source : IPA
Information Security Management Benchmark

The cyber-risk estimation model above is simplified for the use of any industry or any size company. Moredetailed risk estimation services are provided by insurance companies or consulting firms.

Page 5

[Author]
Kenji Uesugi, JCIC Senior Fellow uesugi@j-cic.com
Toshihiro Hirayama, JCIC Senior Fellow hirayama@j-cic.com－ Legal Notice －

The JCIC does not take responsibility for the correctness, up-to-datedness, or quality of the information provided in any report.

The permission of the copyright owner must be obtained, in principle, provided that such permission is not required under certain
circumstances permitted by law. When reusing a JCIC report, please identify the source such as [Source: JCIC].

JCIC contact information : info@j-cic.com

Page 6