Research of SMB’s
Cybersecurity measures inJapan 2021

Introduction
Accidents and damage caused by Cybersecurity incidents are on an
increasing trend year by year, and it is very common to see these reports on
media. Information security is a management subject and, taking
information security measures is an important issue that can no longer be
avoided as enterprise and SMB’s management.
Therefore, this time, we surveyed the actual condition of enterprises and
SMBs aimed at contributing to the reduction of information security risk in
the future.
We hope this survey will be helpful to companies for further efforts.

© MS&AD InterRisk Research & Consulting, Inc.

Findings and Recommendations
The following is a summary of the findings of the survey
and recommendations based on them.

organizationalchangeLessons andLearns

① Improving cybersecurity organization willlead to organizational change.
Companies that have a Cyber Security organizational
structure have relatively superior results in cybersecurity
measures. It is thought that the establishment of Cyber
Security organizational structure will help to clarify themeasures to be taken by the company by initiating
improvement activities, and by having the newly
established structure belong to an organization outside
the company and incorporate external information.
In addition, it was found that the effect of organizational
structure development is not limited to the cybersecurity
field, but also works to the advantage of promoting
telework and cloud utilization. It is believed that security
measures can encourage the incorporation of newtechnologies and corporate reforms.

Launching theorganization
Developing
documents andregulations

Measures/Responses

Networking withoutside

Self
Clarification② Achieving a sustainable supply chain by improving organizational structure
Companies with organizational structures in place are more likely to have cyber countermeasurerequirements across the supply chain than companies without organizational structures in place.
We believe that the establishment of an organizational structure will lead to entry into the supply
chain, improvement in corporate value, and stability.
© MS&AD InterRisk Research & Consulting, Inc.

Findings and Recommendations③ Recommendation to improve system and enhance security through "Managed
Security Services
The survey revealed a trend that security equipment such as network monitoring is not being
operated as installed, and that companies without an organizational structure are not considering
the introduction of endpoint security EDRs. The Managed Security Service is an operational
service for security equipment that provides both monitoring by security experts and security
enhancement. This service is particularly useful for companies that do not have an organizational
structure or the time to develop one.

④ Consider the need for insurance, including additional services.
While cyber insurance subscription rates remain low, the survey found that awareness of cyber
insurance itself is gradually increasing. The survey also found that companies that do not havecyber insurance are seeking ancillary services that function during response and initial response.
Cyber insurance not only compensates for damages caused by accidents, but also has emerged
as a service that reduces the risk of accidents occurring and damage spreading, and it is hopedthat this service will be utilized.

© MS&AD InterRisk Research & Consulting, Inc.

Overview of the ResearchOverview of the Research

Survey method

Mailing questionnaire (combined with Web
response)
10,000 companies in Japan

Targeted companies

Extracted from Toyo Keizai Inc.'s "40,000 company data inJapan ((1) Basic data)"
Companies that randomly extracted in industry by industry

Number of valid
responses

596(total collected number: 600)
Recovery rate 5.9%

Survey period

November 18, 2021 - December 4, 2021
Simple and cross tabulations

Analysis Method*Percentages were rounded to one decimal place,so individual percentage totals may not add up to 100%.
*The number of "non-responses" was not included in the
population.

5© MS&AD InterRisk Research & Consulting, Inc.

Industry and size of the companies

Accommodation, 1.8%

less than 5, 2.0%

Real estate, 2.5%

more than 1,001,
10.6%

Energy, 0.8%

6 to 20, 9.6%501 to 1,000, 8.7%

Minig, 0.2%

Retail, 5.4%
Transport, 6.9%

Manufacture, 30.4%

21 to 50, 17.1%
Construction, 7.7%301 to 400, 10.7%

Number of employee

Industry(n=596)(n=596)
IT,Telecom, 8.7%

51 to 100, 16.3%
101 to 300, 25.0%

Financial, 9.7%

Wholesale, 13.1%

Other Service, 12.8%

6© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Internal Organization Management
cyber security organizational structure * Multiple selection (1/2)
Companies with a Cyber Security organizational structure was 45.5 %, which wasless than half of the respondents, but the percentage is increasing year by year.
" CISO " ( 31.9 %) was the most popular in the companies that replied "Yes".

2021(n=589)

45.5%

2020(n=550)

41.1%

50.2%

8.7%

2019(n=626)

38.7%

52.9%

8.5%

2018(n=672)

36.3%

55.2%

8.5%

SOC

CSIRT

CISO

with Cyber security organization

47.4%

7.1%

without Cyber security organization

Chief Information Security Officer( Also known as : Information Security Officer, Information Security Chief, Chief
Information Security Officer, etc.)
A position that supervises the information security of an organization.
Its main roles are to formulate a security policy (action guideline), direct measures to betaken when a security incident occurs, bridge information security-related matters tomanagement, and manage information security within the organization.
Computer Security Incident Response TeamAn organization that responds to incidents (accidents) and events related to cyber security,
such as information leaks and system failures caused by cyber attacks. Conduct researchand other activities during normal times other than when an incident occurs (emergency).
Security Operation Center
An organization that monitors and analyzes logs generated by information security devices,servers, computer networks, etc., and detects and notifies cyber attacks. There are casesof monitoring within the own organization and service-providing SOCs that monitor
customers.

other

31.9%

CISO
CSIRT
SOC
Other
No

18.7%
14.8%
8.0%
47.4%

8

© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management
cyber security organizational structure * Multiple selection (2/2)
The industry with the highest percentage of companies that answered that they
have a information and telecommunications industry ( 73.1 %) was followed by thefinance and insurance industry ( 60.3 %) .
information and telecommunications industry, the ratio of building SOCs in addition
to CISOs and CSIRTs is larger than the total.
reasons for not building a system are “There are no the human resources andbudget " and " The management is not aware of cyber security issues. "cyber security organizational structure（ALL、IT/Telecomm、Financail）

With organization （by industry）
ALL(n=589)

45.0%

Manufacture(n=179)

Transport(n=41)

43.9%

Retai(n=32)

43.8%

Wholesale(n=76)

60.3%

Accommodation(n=11)

Construction(n=45)
Other Service(n=76)

18.7%

CSIRT

32.1%

Financial(n=57)

Real estate(n=15)

36.8%

73.1%

IT,Telecom(n=51)

Energy(n=5)

31.9%

CISO

36.5%

SOC

54.5%
Other

20.0%

51.3%

41.2%
43.9%

14.8%
3.5%

29.4%

8.0%
7.8%
5.3%

40.0%
43.5%

54.9%

47.4%

No

17.6%

ALL(n=589)

IT,telecomm(n=51)

35.1%
Financel(n=57)

9© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Documents for cybersecurity *Multiple selection (1/2)
The most frequently established security-related document/regulation was the"policy (policy/action guideline)" (62.2%).In addition, companies that have acyber security organizational structure are more likely to have well-developed
documents and rules, according to the results of the survey.
The reasons given by companies that chose "No" for not having security-related
documents/rules included "Do not feel the need" and "It is an implicit rule”.

30.9%
38.2%

All(n=595)
5.2%

organization(n=279)

Policy

44.4%
49.3%

1.5%
2.2%

without Cyber security

17.6%
7.2%

Standard

62.2%

17.5%

with Cyber security
organization(n=268)

47.1%

65.3%

84.3%

41.2%

30.8%
29.4%
33.0%

Procedure

Guideline

other

Nothing

10© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Documents for cybersecurity *Multiple selection (2/2)
The status of maintenance of security-related documents and regulations
was classified into five categories by level as shown below, assuming thatthey are maintained in the following order: policy => standard =>procedure => guideline. This year, only 47.6% of companies maintained
documents and rules in order, slightly lower than the previous year.
2021(n=595)

Level1,

Level2,

Level3,

Level4,

Other,

13.3%

9.6%

8.6%

16.1%

52.4%

47.6%
2021(n=554)

Level1, 16.8%

Level2,

Level3,

Level4,

Other,

10.3%

9.2%

15.5%

48.2%

51.8%
PolicyStandard

Procedure

Guideline

Level４○○○○

Level３○○○―

Level２○○――

Level１

○

―

―

―

Other

Items that do not fall under Levels 1-4

11© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Audit of the documents *Multiple selection(When they answered that they have documents in the previous question)
Among the companies that answered that they have documents and regulations, we
asked whether they are checking and auditing whether the contents described in
the security-related documents and regulations are being implemented. The mostcommon answer was "Audited by a third" (39.4%). Compared to the previous
year's survey, "Not done (no plan)" was slightly higher, indicating that the system
has not made much progress along with the aforementioned maintenance of
documents and regulations.
36.7%
38.8%

Audited by the own department
31.6%
30.5%

Audited by an internal third party

39.4%

Audited by a third

Planning

35.3%
6.1%
7.9%

15.9%
12.3%

Not done (no plan)

other

4.9%
5.5%

2021(n=490)

2021(n=456)

12© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Percentage of telework operations(1/3)
When asked about the "percentage of operations that can be conducted throughtelework when the number of all operations is 10," the most common response was"10 to 30%" (36.6%), followed by "not implemented" (35.7%).

Over 80%

3.5%

40 t0 70%

16.6%

36.6%

10 to 30%

Plamming

not implemented

7.6%

35.7%

13
© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Percentage of telework operations(2/3)
It was found that teleworking is more advanced in the information andtelecommunications industry than in other industries. The information andtelecommunications industry has an advantage, including the aforementioned
cybersecurity system development status.
50%
Manufacture(n=181)

11.0%
1.7%

IT,Telecom(n=52)

19.2%

38.7%

Wholesale(n=78)

3.1%

43.9%
9.4%

2.6%

Financial(n=58)

6.1%

42.5%
32.7%

40.4%

Transport(n=41) 4.9%

Retail(n=32)

100%

92.3%

7.3%

34.4%

43.9%

12.5%

Over 80%

40.6%
40 t0 70%

15.4%

29.5%

19.0%

15.4%

32.8%

Accommodation(n=11)

37.2%

17.2%

45.5%

Energy(n=5)

3.8% 3.8%

31.0%
54.5%

20.0%

10 to 30%

Plamming

80.0%
not implemented

Real estate(n=15)

13.3%

Construction(n=46)
Other Service(n=76)

53.3%
28.3%

6.6%

19.7%

33.3%

30.4%
42.1%

4.3%

37.0%

1.3%

30.3%

14

© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Percentage of telework operations(3/3)
Furthermore, the results by cyber security organizational structure and by existence of
documents/rules showed that the companies that answered "Yes" to each question
had a higher percentage of operations conducted through teleworking.It is consideredthat the development of a telework system together with the development of a cybersecurity system and rules will lead to the promotion of telework.
Percentage of telework operations（by Organization）
with Cyber security
organization(n=268)

5.2%

24.3%

41.0%

5.6%

23.9%

70.5%
without Cyber security
organization(n=279)

2.5% 10.0%

32.3%

7.9%

47.3%

44.8%
Percentage of telework operations（by existence of documents/rules ）existence of
documents/rules(n=283)

5.3%

24.0%

39.9%

6.4%

24.4%

69.8%
Other(n=312) 1.9% 9.9%

33.7%

45.5%

8.7%

45.8%

15
© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

the issues in implementing telework *Multiple selection
When asked about the issues in implementing telework, the most common answer
overall was "Inability to print and seal documents" (65.9%).When asked if they
had experienced a cyber incident, companies that had experienced a cyber incident
recognized "Insufficient security measures for terminals compared to their own
offices" (21.6%) as an issue.
Information security rules related to telework are not yet in
21.4%

6.2%
All(n=337)

place

20.5%
13.4%
18.1%
7.7%

Unsecured network

65.9%

9.5%
9.5%
Experienced(n=74)
4.1%

5.5%

60.8%

The telework environment that was established on an
emergency basis has become the company standard as it is.

21.1%

16.0%
11.8%
15.6%
8.4%
10.5%

Rules for BYOD use and security measures not yet in place

35.1%

21.6%

8.1%

Not experienced(n=237)

their own offices

17.6%
18.9%

Insufficient security measures for terminals compared toInability to communicate

Inability to print and seal documents
66.2%
Nothing

16© MS&AD InterRisk Research & Consulting, Inc.

3rd Party (Subcontractor) Management

3rd Party (Subcontractor) Management
Status of Promotion of Utilization of Cloud Services(1/2)
This year, we started a survey on the status of promotion of cloud service
utilization.The most common answer overall was "partially promoting"(56.3%).By industry, the information and telecommunications industry had thehighest percentage of respondents who answered that they were "fully using"(28.8%) and "partially promoting" (67.3%).
do not have planAll(n=593)

18.0%Stage of study started

56.3%

9.1%

16.5%

partially promoting
fully using

Manufacture(n=178)
IT,Telecom(n=52)

21.3%

67.3%

1.9%
14.6%

Retail(n=32)

12.5%

Construction(n=46)
Other Service(n=76)

68.3%

12.5%

53.1%

3.8%
10.3%

18.2%

14.5%

21.9%
11.5%
46.6%

63.6%
33.3%

17.4%

4.9%

69.2%

27.6%

Real estate(n=15)

13.5%

28.8%

12.2%

15.4%

Financial(n=58)
Accommodation(n=11)

56.2%

1.9%

Transport(n=41)

Wholesale(n=78)

9.0%

15.5%
18.2%

6.7%
17.4%

13.2%

13.3%
39.1%
53.9%

26.1%
18.4%

18
© MS&AD InterRisk Research & Consulting, Inc.

3rd Party (Subcontractor) Management
Status of Promotion of Utilization of Cloud Services(2/2)
In addition, the results by cyber security organizational structure anddocuments/rules showed that companies that answered "Yes" to each question
were more likely to promote the use of cloud services, especially those thatanswered "fully promoting" were twice as likely as those that answered "Yes". thekey to promoting the use of cloud services is to implement them together
with the development of a cyber security organizational structure and rules.
Status of Promotion of Utilization of Cloud Services（By Organization）
with Cyber security
organization(n=266)

10.2%9.8%

57.1%

22.9%
without Cyber security
organization(n=278)

24.8%

10.1%

54.0%

11.2%

Status of Promotion of Utilization of Cloud Services（by existence of documents/rules ）existence of
documents/rules(n=281)

9.6% 9.6%

59.4%

21.4%
Other(n=311)

25.4%

8.7%

53.7%

12.2%

19
© MS&AD InterRisk Research & Consulting, Inc.

3rd Party (Subcontractor) Management
Security Evaluation at Cloud Service Providers Selection (1/2)
Compared to the increasing trend from FY 2019 to FY 2020, the number of answers
indicating that the company is evaluating the company was lower in FY 2020 to FY
2021.In FY2020, teleworking spread rapidly, internal assets were shifted to cloudservices, and each company evaluated cloud service providers. In FY2021,
teleworking promotion settled down, but continued security evaluation is notconsidered to have taken root.

2021(n=475)

2021(n=441)

2019年度(n=488)

63.6%

36.4%

66.2%

33.8%

57.0%

43.0%
Evaluation

Not Evaluation

20© MS&AD InterRisk Research & Consulting, Inc.

3rd Party (Subcontractor) Management
Security Evaluation at Cloud Service Providers Selection (2/2)
Overall, the most common choice on the survey form was "I use the Guide to
Secure Use of Cloud Services for SMEs (IPA)" (15.2%).
Other measures used for security evaluation included "third-party certification (ISO,
SOC2, etc.)," "other company's use record," and a few answers that cited "ISMAP"
as a measure used for security evaluation.

ENISA

1.8%

JNSA's Guideline

2.6%

External databases

3.9%

15.2%

IPA's Guideline
CloudControlMatrix(CSA)

0.4%

Other than the five listed on

35.6%

Not Evaluation
other

30.3%
16.8%

21
© MS&AD InterRisk Research & Consulting, Inc.

3rd Party (Subcontractor) Management

Supply Chain Risk Management Status(1/3)
These days, corporate cyber risks have a significant impact not only on thecompany itself, but also on the supply chain in which it participates. In thissurvey, 48.6%(①+②）of the total respondents answered that they are【image】
required to take cyber security measures by their supply chain.
①②③

consignor④① ② ③ ④All(n=580)

31.2%

17.4%

10.5%

40.9%

48.6%
Responding
company
image①

image②

image③

image④

consignee
22© MS&AD InterRisk Research & Consulting, Inc.

3rd Party (Subcontractor) Management

Supply Chain Risk Management Status(2/3)
Among companies with an organizational structure, the percentage of companies that responded,"Our contractors require us to take cyber security measures, and we also require our contractors
to take such measures," was 2.5 times higher than the percentage of companies that responded
that they do not have an organizational structure.The percentage of companies that responded,"We request security checklists and other measures from our contractors.
【image】
In some cases, the contractor company hastily established an organizational
structure, while in other cases, the contractor company established anorganizational structure in advance. In some cases, the company was able toconsignor
meet the requirements smoothly by We believe that there are some cases.
① ② ③ ④①②

with Cyber security

44.2%

organization(n=265)

without Cyber
security
organization(n=269)

①

17.0%

② ③

17.8%

5.2%

image①③④
15.5%

Responding
company④
20.1%

image②

23.4%

56.9%

image③

image④

consignee
23© MS&AD InterRisk Research & Consulting, Inc.

3rd Party (Subcontractor) Management

Supply Chain Risk Management Status(3/3)
When asked about specific cyber security requirements among supply chain companies, the mostcommon response for both requirements from the outsourcing source and requirements foroutsourcing partners was "declaration of security measures status (description in check sheets)"(75.1% and 67.6%), followed by "specific security measures" (75.1% and 67.6%).
Implementation" (55.2% and 54.4%).Based on these results, we propose the following roles foreach company in the supply chain.
The consignor side should take the lead in strengthening the entire supply chain system byrequesting cyber security measures from the outsourcing partner companies, thereby realizing asustainable and stable supply chain.
The consignee side should prepare a cyber security organization system in advance to meet theever-increasing demand for cyber security measures among supply chain companies and establish
a system for outsourcing business. This not only strengthens the company's own cybercountermeasures, but also has the direct business benefit of increasing corporate value, which
increases opportunities for outsourcing.

67.6%
75.1%

declaration of security measures status(description in check sheets)
35.7%

Conducting audits

54.4%
55.2%

Implementation of specific security measures
Conduct security assessment and report

28.6%
32.0%

results
16.6%
14.2%

Third-party certification
Cyber Insurance

6.2%

other

5.0%
3.2%

Nothing

45.2%

2.9%
1.4%

12.5%

Requirements from the consignee(n=241)

Requirements from the consignor(n=281)

24© MS&AD InterRisk Research & Consulting, Inc.

Identify

Identify

Issues with information assets held
(e.g., confidential information is placed where anyone can refer to it, passwords are
not encrypted, etc.)

Overall, only 34.0% of companies answered that they manage both issues andvulnerabilities.When this question was asked by cybersecurity organizational
structure, 47.4% of companies with cybersecurity organizational structureanswered that they “manage issues and vulnerabilities,” while 22.5% ofcompanies without cybersecurity organizational structure answered that they
“manage issues and vulnerabilities. A large difference was observed dependingon whether or not a company has a cybersecurity organizational structure.
All(n=591)

34.0%

with Cyber security

47.4%

organization(n=266)

without Cyber security
organization(n=276)

44.7%

22.5%

8.5%

43.6%

45.7%

12.3%

manage both issues and vulnerabilities
Some of the issues and vulnerabilities are manageable.
Planning to manage issues/vulnerabilities
Issues/vulnerabilities are not managed (nor planned)

12.9%

4.1%4.9%

19.6%

26

© MS&AD InterRisk Research & Consulting, Inc.

Identify

Vulnerability management（e.g., Vulnerabilities in Windows, Adobe Flash, etc.)
The total number of responses that manage vulnerabilities (“Management methods
are defined and reflected in the asset management ledger (automatically or manual
updates)" and "Managed, but updated information is not reflected in the asset
management ledger") was 42.9%.A particularly large difference was observed
between those with and without a cyber security organizational structure, at 60.6%
and 28.2% respectively.Cyber-attacks that exploit vulnerabilities have recently
been attracting attention as a major threat, and companies are required to manage
vulnerabilities in their cyber security organizational structure.

All(n=591)

17.3%

25.2%

organization(n=266)

organization(n=276)

11.0%

38.2%

5.1%

13.9%

42.9%

with Cyber security

without Cyber security

14.6%

21.1%

14.3%

31.2%

4.5%
3.8%

60.6%
11.2%

9.8%

7.2%

42.8%

6.2%

22.8%

28.3%

Management methods are defined and reflected in the asset management ledger (automatically)
Management methods are defined and reflected in the asset management ledger (manual updates)
Managed, but updated information is not reflected in the asset management ledger
Partially managed
Planning
Not manegement27© MS&AD InterRisk Research & Consulting, Inc.

Identify
Develop rules for user IDs, passwords, and authorization to view andupdate information
About half (41.9%) of all companies answered that they have documented
rules for IDs, passwords, and updating information references, and that theserules are checked and reviewed. The percentage of companies with a cyber security
system was 57.5%, while the percentage of companies without a cyber security
organizational structure was 26.4%, which is a large discrepancy. " Other" included"No rules, but inspections are conducted," "Dependent on/compliant with parent
company", and "Only computers that handle personal information" are inspected.

All(n=594)

41.9%

16.8%

5.2%

22.6%

11.8%
1.7%

with Cyber security

57.5%

organization(n=268)

18.3%

16.0%

0.7%

2.6%
without Cyber security
organization(n=277)

26.4%

16.2%

7.6%

28.5%

4.9%

19.1%
2.2%

Rules are documented, inspected and reviewed.
Planning to document the rules
No rules (and no plan)

Rules are documented but not inspected or reviewed
There are rules, but they are not documented
other

28
© MS&AD InterRisk Research & Consulting, Inc.

Detection, protection, response, and recovery status

Detection, protection, response, and recovery status
Boundary protection between the Internet and the company‘sown network（e.g., firewalls）
We checked the status of implementation of boundary protection between theInternet and the company's own network. Overall, more than half of thecompanies (58.7%) have purchased and are operating firewalls and otherequipment.On the other hand, 27.9% of companies "have purchased firewalls andother equipment but are not operating them" indicating that they are unable torespond immediately to cyber attacks or to fully demonstrate the effectiveness of
their security products and services, and that issues remain regarding theeffectiveness and efficiency of their countermeasures.For companies that do nothave the resources to operate their own systems, it is recommended thatthey introduce a "managed security service (MSS)" that provides one-stop
services, including monitoring and incident response.

All(n=591)

58.7%

27.9%

4.4%
2.0%

5.8%

1.2%

purchased and are operating firewalls and other equipment
have purchased firewalls and other equipment but are not operating them
Planning to implement perimeter defenses
No perimeter defenses in place
Not connected to the Internet

30© MS&AD InterRisk Research & Consulting, Inc.

Detection, protection, response, and recovery status
Deployment of EDR（1/2）
Regarding the status of EDR (Endpoint Detection and Response)
implementation, 49.2% of all companies answered that they have
implemented EDR (total number of "implemented on all PCs" and"on some PCs"). When broken down by industry, the real estate(60.0%), retail (53.1%), manufacturing (50.8%), and other services(49.3%) industries exceeded the overall average.
50%

100%

All(n=591)

49.2%

47.2%

Manufacture(n=179)

50.8%

44.7%

IT,Telecom(n=52)
Transport(n=41)

48.1%

53.1%
48.7%

Financial(n=57)

49.1%

Real estate(n=15)
Construction(n=46)
Other Service(n=75)

1.9%

63.4%

Wholesale(n=78)

Energy(n=5)

4.5%

50.0%

36.6%

Retail(n=32)

Accommodation(n=11)

3.6%

40.6%

6.3%

47.4%

3.8%

50.9%

45.5%

54.5%

40.0%

40.0%

60.0%
52.2%

43.5%

49.3%
installed

20.0%

33.3%

46.7%
Not installed

other

6.7%

4.3%
4.0%

31

© MS&AD InterRisk Research & Consulting, Inc.

Detection, protection, response, and recovery status
Deployment of EDR（2/2）
When this question was asked by cyber security organizational structure,
the percentage of companies without an organizational structure thatanswered " Not installed " was approximately 1.6 times higher thanthat of companies with organizational structure.For companies without ancyber security organizational structure, outsourcing EDR security
operations through Managed Security Services (MSS) has theadvantage of simultaneously strengthening the security structure
and countermeasures.
with Cyber security
organization(n=268)

without Cyber security
organization(n=275)

42.5%

33.1%

7.5%

4.4%3.6%

10.9%

7.1%

14.2%

27.2%

43.3%

1.5%

4.7%

Installed on all PCs.
Installed on some PCs and there are plans to install it on all of PCs
Installed on some PCs and have no plans to install it on all of them.
Not installed, but planning to install
Not installed
other

32
© MS&AD InterRisk Research & Consulting, Inc.

Detection, protection, response, and recovery status
Contracts for emergency support services, etc. in the event of
a security incident (accident)
There was a large difference in the response rate for " No contract for
emergency response services and no plan for such services " byCyber Security organizational structure status.In cases where cybersecurity systems are not yet in place or where budget and personnel
allocation are difficult, there is significant potential for proactive use ofservices such as referrals to specialized providers that are included
in cyber insurance policies in the event of an accident.
All(n=588)

20.6%

31.3%

32.5%

6.0% 4.9%

4.8%

with Cyber security
organization(n=267)

without Cyber security
organization(n=273)

24.3%

42.3%
5.2%

16.5%

24.2%
3.3%

19.5%

42.5%

Contracted emergency response services in the event of an incident
Emergency response to incidents is conducted in-house
Plan an emergency response service agreement in the event of an incident
No contract for emergency response services and no plan for such services
I am considering contracting emergency response services to respond to an incident when it occurs
other

6.0%
2.6%

6.6%

7.0%

33

© MS&AD InterRisk Research & Consulting, Inc.

Detection, protection, response, and recovery status

Status of security incident training
Regarding whether they conduct training in the event of a security incident, the majority(57.8%) of all companies answered that they "no training (no plan)”.When this question was
examined by the presence or absence of a cyber security organizational structure, there was adivergence in the percentage of respondents who answered "no training (no plan)" dependingon the presence or absence of an organizational structure. Companies with an organizational
structure are able to make appropriate judgments and responses as an organization, and torespond to security incidents while also making use of past experience. For companies that do
not have an organizational structure, it is desirable for them to develop an organizational
structure, including incident training, and to strengthen the structure, including
outsourcing of incident response.

All(n=592)

16.4%

10.0%

57.8%

13.2%

2.7%
with Cyber security

26.9%

organization(n=268)

without Cyber security
organization(n=277)

13.4%

41.4%

16.4%

1.9%

6.9%

6.9%

9.0%

73.6%
Training is provided
Training is provided (IT department only)
Training is planned.
"no training (no plan)

3.6%

34
© MS&AD InterRisk Research & Consulting, Inc.

Detection, protection, response, and recovery status

Whether or not the results of security incident
training are reviewed.
63.5% of all companies are reviewing the results of their training and thecontent of their training, and including those that "Plans to review"(21.2%), the number of companies that have reviewed or plan to review
the content of their training exceeds 80%.On the other hand, about 30%
of companies without a cyber security organization have notreviewed their training.
All(n=156)

63.5%

21.2%

11.5%

3.8%

84.7%
with Cyber security
organization(n=108)

without Cyber security
organization(n=38)

63.0%

55.3%

Review

25.9%

13.2%

Plans to review

Not reviewed

9.3% 1.9%

21.1%

other

10.5%

31.6%
35

© MS&AD InterRisk Research & Consulting, Inc.

Detection, protection, response, and recovery status

Implementation status of training for incoming Fishing
Emails(1/2)
Regarding whether they conduct training on incoming Fishing Emails, 40.7% of thetotal respondents answered that they "Training is provided“. This is a slight increase
from the results of the FY2020 survey and suggests that company-wide training is
gradually spreading.Also, compared to the aforementioned security incident
training, which is a broad topic, a higher percentage of respondents conduct
training, suggesting that Fishing emails have become a more familiar threat tocompanies.
2021(n=589)

40.7%

11.9%

40.7%

1.2%

2.0%

2021(n=552)

38.9%

10.7%

42.0%

4.7%

3.6%
Training is provided

Training is provided (IT department only)

Training is planned.

"no training (no plan)

other

36
© MS&AD InterRisk Research & Consulting, Inc.

Detection, protection, response, and recovery status

Implementation status of training for incoming Fishing
Emails(1/2)
Many companies with an Cyber Security organizational structure (60.3%) answeredthat they "conduct training (the total number of companies with non-IT department
participation and IT department participation only). On the other hand, less than
27.1% of the companies without an Cyber Security organizational structureanswered "Yes" to this question.Establishing an organizational structure as well
as security incident training is the first step in strengthening the subsequent
security structure.
with Cyber security

57.7%

organization(n=267)

13.5%

22.8%
3.4%

2.6%

60.3%
without Cyber security

25.7%

organization(n=276)

9.8%

57.2%
5.8%

1.4%

27.1%
Training is provided

Training is provided (IT department only)

Training is planned.

"no training (no plan)

other

37
© MS&AD InterRisk Research & Consulting, Inc.

Detection, protection, response, and recovery status
Whether or not the results of training for Fishing Emails havebeen reviewed (1/2)
Including those companies that are planning to review Fishing Emails
training (10.4%), more than 80% of the companies have reviewed or areplanning to review their training content.In Fishing Emails attacks, it isdifficult to reduce the open rate to zero, so it is important to educate
and train employees so that they can quickly and appropriately
report and take other actions when they do open an email.

All(n=251)

73.3%

10.4%

12.0%

4.4%

83.7％
Review

Plans to review

Not reviewed

other

38
© MS&AD InterRisk Research & Consulting, Inc.

Detection, protection, response, and recovery status
Whether or not the results of training for Fishing Emails havebeen reviewed (2/2)
Fishing Emails training service we provide comes in two types: a full
package plan that includes "pre-learning," "training e-mails," and "postlearning," and a plan that includes only training e-mails. The fact that thefull package plan accounts for more than 70% of the service offerings
suggests that there is a need for training that includes actions to betaken when targeted emails are opened.

39© MS&AD InterRisk Research & Consulting, Inc.

Cyber Security Incidents

Cyber Security Incidents

Past cyber security incidents (1/2)
When asked if there had been any cyber security incidents in the past,
16.3% of the companies answered “Yes". By cyber security system, ahigher percentage (10.0%) of companies without an organizational
structure answered that they "do not know/not aware," suggesting thatthey may not have detected the incident even if it had occurred in
the first place.

All(n=595)

16.3%

75.3%

6.4%
2.0%

with Cyber security
organization(n=268)

18.7%

77.2%
2.6% 1.5%

without Cyber security
organization(n=279)

14.0%

73.5%

10.0%
2.5%

Yes

No

do not know/not aware

refusal to answer

41© MS&AD InterRisk Research & Consulting, Inc.

Cyber Security Incidents

Past cyber security incidents (2/2)
The percentage of companies that answered that there were incidents was higher
for companies with a larger number of employees.It can be inferred that large
companies are more likely to experience cyber attacks as the ultimate goal oftargeted attacks and supply chain attacks, in addition to indiscriminate attacks.
In addition, 10.7% of companies with 6 to 20 employees answered that they "do notknow" or "do not understand," suggesting that they may not have detected theincident even if it had occurred in the first place.
less than 5(n=12)

91.7%

6 to 20(n=56) 5.4%
21 to 50(n=102)
51 to 100(n=97)

8.3%

83.9%

8.8%

10.7%

84.3%

16.5%

6.9%

73.2%

6.2%
4.1%

101 to 300(n=149)
301 to 500(n=64)

501 to 1,000(n=52)
more than 1,001(n=63)

16.8%

73.2%

20.3%
23.1%
30.2%

Yes

No

do not know/not aware

7.4%
2.7%

75.0%

1.6%
3.1%

69.2%

5.8%
1.9%

63.5%
refusal to answer

4.8%
1.6%

42
© MS&AD InterRisk Research & Consulting, Inc.

Cyber Security Incidents
Details of the most damaging cybersecurity incidents
When asked about the most damaging cyber security incidents in the past, the mostcommon answer was leakage of personal and confidential information (20.0%),
followed by business shutdown (13.7%).For this question, the percentage of
respondents who answered "Do not know/not aware" varied nearly twice as muchdepending on whether or not a cyber security system was in place. We believe thathaving a cyber security system in place at normal times will be helpful inunderstanding the situation in the event of an emergency.

All(n=95)

13.7%

20.0%

20.0%

32.6%

12.6%

1.1%
with Cyber security
organization(n=49)

26.5%

12.2%

14.3%

34.7%

10.2%

2.0%
without Cyber security
organization(n=38)

15.8%

7.9%

28.9%

34.2%

Suspension of business and leakage of personal and confidential information
Suspension of businessLeakage of personal and confidential information
do not know/not aware
otherrefusal to answer

13.2%

43

© MS&AD InterRisk Research & Consulting, Inc.

Cyber Security Incidents

Amount of losses from the most damaging
cybersecurity incidents
When asked to confirm the amount of damage caused by the mostdamaging cyber security incidents in the past, 39.6% of the respondents
reported losses of less than 1 million yen, followed by 1 million to 10
million yen (8.8%) and 10 million to 50 million yen (7.7%).Again, thepercentage of respondents who answered "do not know/not sure" varied
about twice as much depending on whether or not they have a cybersecurity system.
All(n=91)

with Cyber security

organization(n=49)

without Cyber security
organization(n=36)

39.6%
38.8%

8.8% 7.7%

14.3%

10.2%

31.9%

12.1%

24.5%

12.2%

41.7%

41.7%

8.3%

2.8% 5.6%～Less than 1 million yen
10 million yen to less than 50 million yen

1 million yen to less than 10 million yen
50 million yen to less than 100 million yen

44© MS&AD InterRisk Research & Consulting, Inc.

Cyber Security Incidents

Reason for recognizing the incident“How the enterprise recognized the accident?”.
The results were as follows:
1st “report from employee”
2nd” Detection in the system”, “Notifications and inquiries from outside”
Compared to FY2020, the percentage of responses for "notification or
inquiry from outside the company," such as from the police or security
vendors, increased (from 10.4% to 20.9%).In order to minimize damage,it is desirable to "detect cyber-attacks in-house" and "respond promptly
and appropriately.
2021(n=86)

38.4%

20.9%

20.9%

9.3%

5.8%

1.2%

3.5%
2.6%

2021(n=77)

42.9%

28.6%

3.9%

10.4%

9.1%
2.6%

report from employee
Detection by outsourced monitoring systemother

Detection in the system
Notifications and inquiries from outside
do not know/not aware

45© MS&AD InterRisk Research & Consulting, Inc.

Cyber Insurance

Cyber Insurance

Status of cyber insurance(1/2)
Overall, the percentage of companies with cyber insurance is low at
26.0%, but compared to the results of the previous years' surveys, thepercentage of companies with cyber insurance has been increasing
every year, especially in FY2021, more than the trend has been.
2021(n=592)

26.0%

2021(n=546)

16.8%

2019(n=622)

14.6%

2018(n=661)

12.7%

13.5%

13.7%

10.5%

10.8%

companies with cyber insurance

60.5%

69.4%

74.9%

76.5%

Companies in the planning stages

companies without cyber insurance

47© MS&AD InterRisk Research & Consulting, Inc.

Cyber Insurance

Status of cyber insurance (2/2)
A difference in Purchase ratio was observed when checking by the presence ofa Cyber Security organizational structure. The company rate who has cyber
insurance policy with an Cyber Security Tema was 32.3%, while the rate for
who has insurance policy without a Cyber Security organizational structure
was 19.4%, a difference of 1.5 times the rate for those without astructure.
with Cyber security
organization(n=266)

without Cyber security
organization(n=278)

32.3%

19.4%

14.9%

11.1%

52.2%

69.2%

companies with cyber insurance48© MS&AD InterRisk Research & Consulting, Inc.

Cyber Insurance

The reason who have policy * Multiple selection
The most common reason given for purchasing cyber insurance was"coverage suited to my company" (76.6%).Compared to last year's answer
rate, there was a particular increase in the percentage of respondents who
answered "request from business partners" (from 9.9% to 14.9%) and"supplementary insurance services" (from 9.9% to 20.8%) as reasons fortheir decision.
76.6%

Coverage

80.2%
56.5%
51.6%

insurance premium
44.8%
44.0%

Amount of insurance
Requests from business partners

9.9%

Insurance supplementary services
Security equipment with cyber insured
other

14.9%

9.9%

20.8%

3.2%
1.1%
10.4%
12.1%

2021(n=154)

2020(n=91)

49© MS&AD InterRisk Research & Consulting, Inc.

Cyber Insurance

The reason who don’t have policy * Multiple selection(1/2)
Compared to last year's survey, the most common answer for not having
cyber insurance was "do not feel the need to purchase insurance(31.2%).Compared to last year's response rate, the percentages of "didnot know insurance existed" and "other" decreased, while thepercentages of all other responses increased.While the awareness rateof cyber insurance is increasing, the number of companies that do not
feel the need to purchase cyber insurance is also increasing.
17.6%

did not know insurance existed
never received a proposal.

25.8%

19.9%

I don't feel the need to purchase insurance.

23.2%

28.0%

31.2%

17.4%
15.4%

difficult to understandHigh insurance premiums

16.5%

19.1%

11.8%
12.9%

other
2021(n=340)

2020(n=357)

50© MS&AD InterRisk Research & Consulting, Inc.

Cyber Insurance

The reason who don’t have policy * Multiple selection(2/2)
When asked by Cyber Security organizational structure, the most common
answer among companies with organizational structure was "I don't feelthe need to purchase insurance" (27.5%), followed by "I knew there
was insurance, but I have never received a proposal" (27.5%).On theother hand, in the absence of organizational structure, the most common
response was the same, but the second most common response was "I
don't know what insurance is or it is difficult" (22.5%).
did not know insurance existed

13.0%

27.5%
30.4%

with Cyber security
organization(n=138)

10.1%

never received a proposal.

24.6%
12.3%

I don't feel the need to purchase insurance.

20.2%

difficult to understand

21.9%
without Cyber security
organization(n=178)
13.5%
11.2%

30.3%
22.5%

High insurance premiums

other

51
© MS&AD InterRisk Research & Consulting, Inc.

Cyber Insurance

Required coverage * Multiple selection
The most common loss expected to be covered by insurance was"compensation for damages at the time of information leakage"(70.6%), 2nd is "response/restoration costs" (65.0%).Compared to
the response rate in the previous year, there was no significant change inthe response trend.
65.0%

Response and restoration costs

59.8%

70.6%

Compensation for damages in the event of information leaks

68.0%
26.5%
25.4%

Sales and profits during system interruption

35.5%
36.2%

Cost of preparation and purchase of substitute equipment, etc.

othernothing2021(n=592)

1.4%
1.8%
16.2%
20.7%

2021(n=547)

52© MS&AD InterRisk Research & Consulting, Inc.

Cyber Insurance

Expectations for additional insurance services(1/3)
Expected services, in particular, were "call center for consultation(55.7%)," "rush service in case of accidents (45.8%)," and"vulnerability assessment (33.5%)," in that order.
55.7%

Call center for consultation (n=575)

26.3%

45.8%

Rush services in case of accidents (n=576)

30.7%

33.5%

Vulnerability assessment(n=576)

9.7% 8.3%

43.2%

15.3%

8.2%

15.8%

7.5%

Support for building an initial incident response system(n=576)

24.0%

44.1%

22.0%

9.9%

Protection - detection - initial response to an incident package service (n=576)

23.8%

43.1%

22.4%

10.8%

Security assessment (scoring) services (n=574)

23.7%

46.9%

20.2%

9.2%

Service to calculate expected (maximum) damage(n=575)

23.3%

44.7%

22.1%

9.9%

security equipment with cyber insurance(n=573)

22.3%

Support for creating policies, standards, procedures(n=575)

21.0%

42.1%

Assistance in complying with the revised Protection of Personal Information(n=575)

20.2%

46.4%

Referral service for professional (forensic) services in case of accident (n=574)

17.9%

39.5%

29.8%

12.7%

Providing intelligence information on the dark web, etc. (n=572)

15.4%

41.1%

32.3%

11.2%

Support for building organizational structure (n=574)

15.3%

Asset management support (n=574)

12.9%

33.6%

35.9%

17.6%

Security vendor referrals (n=574)

11.1%

34.8%

35.5%

18.5%

Not really necessary

Not necessary

necessaryrather necessary

35.6%

35.0%

28.6%
23.0%
23.1%

32.9%

13.4%
13.9%
10.3%

16.7%

53

© MS&AD InterRisk Research & Consulting, Inc.

Cyber Insurance

Expectations for additional insurance services (2/3)
When compared to the answers for "necessary" in terms of ancillary services by cyber
accident status, the first three responses were the same, but the fourth and fifth
responses were services related to accident response for companies that haveexperienced cyber accidents, and services related to cyber security scoring anddiagnosis for companies that have not experienced cyber accidents.The percentage of
respondents who answered that a call center for consultation and a rush service atthe time of an accident are "necessary" was slightly lower among those with cyber
accident experience. The results show that the need for supplementary services
differs depending on the company's experience with accidents.
Expectations for additional insurance services（ Experienced cyber incidents ）Call center for consultation (n=92)

Expectations for additional insurance services（Not experienced cyber incidents ）48.9%
Call center for consultation (n=435)

Rush services in case of accidents(n=92)
Vulnerability assessment(n=92)
Protection - detection - initial responseto an incident package service (n=92)
Support for building an initial incident
response system(n=93)

39.1%

55.6%

Rush services in case of accidents

47.5%(n=436)
34.8%

27.2%

Vulnerability assessment(n=436)
Service to calculate expected(maximum) damage(n=434)
Security assessment (scoring) services

25.8%(n=435)

33.5%
24.7%
24.1%

54
© MS&AD InterRisk Research & Consulting, Inc.

Cyber Insurance

Expectations for additional insurance services(3/3)
When the ancillary services that were selected as "necessary" were compared withthe responses by cyber insurance status, the following results were obtained.Although
the first three responses were the same, a higher percentage of companies without
cyber insurance selected "security equipment with cyber insurance" and " Protection detection - initial response to an incident package service " as "necessary ".
The services ranked first through fifth are particularly effective during response andinitial response, suggesting that cyber insurance is required not only to compensate
for damage caused by cyber accidents, but also to reduce such damage.
Companies that do not have cyber insurance policy

Ranknecessary service

1
2
3
4
5
6
7

Call center for consultation(56.7%)
ush services in case of accidents(47.1%)
Vulnerability assessment(30.8%)
security equipment with cyber insurance(24.6%)
Protection - detection - initial response to an incident package service(23.0%)
Security assessment (scoring) services(22.2%)
Service to calculate expected (maximum) damage(21.0%)

Rank(have cyber
insurance
policy)
１
２
３
12
6
5
7
55

© MS&AD InterRisk Research & Consulting, Inc.

Cybersecurity MS&AD Platform
Ins.

RatingManagements during
normal times

Cyber Security
Framework

Team building(CSIRT)

Forensics

Threat intelligence
service

Managements
during emergency

Targeted Mail
Training

Emergency
training

Endpoint security

Consulting for Cybersecurity
accountability
Security Awareness Trainings

SME’s

Enterprise

CSIRT training

Risk Consulting

Cost, Liability,
Introduce Vender etc.

Questionnaire

Incident
Seminner

PML

Education and Trainings

Survey of InfoManagement

Web severassessment

Exit Control

Education and Trainings

Survey of InfoManagement

Web severassessment

Exit Control

Consulting for “SECURITY ACTION Double star”

Internal and External
control & management

•
•
•
•

Managed Security
Service

PolicyEstablishment of team
Budget & Resources
External contract andmanagement

Managed Security
Service

Targeted Mail
Training
Emergency
training
Incident
Seminner

Identify

Protect

DetectRespond &Recover• Validation ofAsset tracking• Etc.

• Firewall• Access
Management• Anti-Malware• Etc.

• Monitoring &log manage• Etc.

⑤復旧に向けた手順書策定や、訓練による準備・見直し【復旧手順書、訓練実施報告書】

56© MS&AD InterRisk Research & Consulting, Inc.

MS&AD InterRisk Research & Consulting, Inc.
Cyber Risk Sec.
WATERRAS ANNEX, 2-105 Awaji-cho, Kanda,
Chiyoda-ku, Tokyo 101-0063, Japan
Tel：03-5296-8961／Fax：03-5296-8940
https://www.irric.co.jp/© MS&AD InterRisk Research & Consulting, Inc.