Research of SMB’s
Cybersecurity measures inJapan 2019

Introduction

Introductions<Introductions>
Accidents and damage caused by Cybersecurity incidents are on an increasing
trend year by year, and it is very common to see these reports on media.
Information security is a management subject and, taking information security
measures is an important issue that can no longer be avoided as enterprise and
SMB’s management.
Therefore, this time, we surveyed the actual condition of enterprises and SMBs
aimed at contributing to the reduction of information security risk in the future.
We hope this survey will be helpful to companies for further efforts.

© MS&AD InterRisk Research & Consulting, Inc.

Introductions<Insights>① Companies that have an organized Cybersecurity Team (structure) have advantageous results in
Cybersecurity measures as well as rates of having cyber insurance. One of the reasons for measures
to be taken by developing the organizational structure is that making 'what should be implemented'
clearer by external information which is provided from organizations outside the company (ex.
Nippon CSIRT Association, JNSA, IPA, etc.).
② In addition to the organizational structure improvement, the policy ⇒ standard ⇒ procedure, that thecorrespondence with documents and rules also developed into more practical one is also a point as amatter of actual security measures.
Organize
Cybersecurity team
Reviewing and
PDCA cycle
Documents & Rules
Get external
information

Remediation

Clarify theremediation points③④⑤

As the usage of the cloud service by SMB expands in the future, "Develop a model of a recommended
system architecture includes cloud services which are trusted by SMBs for utilization" can be
mentioned as a countermeasure.
Companies without Cybersecurity Team need to contract a services that can treat the possibility ofcyber accidents (incidents) when the total damage is still small.
About cyber insurance, companies are not understanding its existence and contents (compensation
scope, targeted accident, etc.).
© MS&AD InterRisk Research & Consulting, Inc.

Overview of the ResearchOverview of the Research

Overview of the Research
Survey method

Mailing questionnaire (combined with Web
response)

Targeted companies

10,000 companies in Japan
Extracted from Toyo Keizai Inc.'s "40,000
company data in Japan ((1) Basic data)"
Companies that randomly extracted inindustry by industry

Number of valid
responses

634 (total collected number: 644)
Recovery rate 6.3%

Survey period

November 13 - November 30, 20195
© MS&AD InterRisk Research & Consulting, Inc.

Overview of the Research

Industry and size of the companies
Energy, Mining, 0.2%
0.9%

Manufacture,

Other,

Accommodat

30.8%

15.5%

ion, 1.3%
Real estate,
2.1%（n=634）Retail, 6.0%
Wholesale,Transport,

1,001 or more

11.5%

7.6%

employees,

employees,

Construction,
7.7%

Under 5
5.2%

6.3%

Financial,

IT, Telecom,

7.9%

8.7%

（n=634）1,000employe

21～50

es, 7.7%

employees,
15.0%

301～
10.1%

employees,
10.3%

501～

500employees,

6～20

101～
300employees,
27.4%

51～100employees,
18.0%

6

© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Internal Organization Management

Cybersecurity Team *Multiple selection

The majority of responding companies have not established acybersecurity team. But ”CISO” is most popular in the companies that
replied "Yes".
ALL(n=626)

0%

20%

40%

60%

52.9%

38.7%
Have Security Team80%

No Security Team

100%

8.5%
Other

60%

52.9%

40%

26.4%
20%

16.1%

13.9%
8.9%

0%

CISO

CSIRT

SOC

Other

No

8

© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Cybersecurity team established *Multiple selection
Looking further by the number of employees, 42.5% of companies withmore than 1,001 employees are establishing "CSIRT“ and/or "SOC“,and the organization size is considered to be related to the establishment
of Cybersecurity team.
The percentage of enterprises that have “SOC" has increased
significantly from 2018.（2018:27.7%→2019:42.5%）。
60%

52.9%

42.5%

42.5%

40%
26.4%

30.0%
16.1%

20%

0%

25.0%

CISO

CSIRT
(n=626)

13.9%

SOC

8.9%

5.0%

Other

1001 or more employees(n=40)

No
9© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Documents for cybersecurity *Multiple selection“Policies” (58.6%) are most frequently maintained as cybersecurity
documents and regulations.
In the “Other”, there were answers such as ‘It complies with the groupcompany/parent company’, ‘It is incorporated in the company regulations
such as rules of employment’ and etc..
In the “No documents”, there were answers such as ‘There is no
department in charge.’, ‘Cost’ and etc..
ALL(n=631)

With Cybersecurity Team(n=242)

Without Cybersecurity Team(n=329)

100%
82.2%
80%
60%
40%

67.4%

58.6%
40.1%

45.0%

43.3%

39.5%

35.3%
24.3%

20%
0%

49.6%

25.4%

24.0%
9.4%

PolicyStandard

Procedure

Guideline

22.2%
5.1%5.4%4.0%

1.2%

Other

No documents

10© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Documents for cybersecurity *Multiple selection
Assuming that the status of development of security documents is to be
improved with policy ⇒ standard ⇒ procedure ⇒ guidelines and classified
into 5 categories according to level as below, nearly half of companies
organize documents in order.
0%

20%

14.3%

46.1%

40%

10.3% 7.4%

Level１(n=90)

60%

14.1%

Level２(n=65)

80%

100%

53.9%

Level３(n=47)

Level４(n=89)

Other(n=340)

PolicyStandard

Procedure

Guideline

Level１○―――

Level２○○――

Level３○○○―

Level４

○

○

○

○

Other

ー
11
© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Audit of the documents *Multiple selection(When they answered that they have documents in the previous question)

36.7% of the companies chose “External 3 rd party Audit”.
(n=488)

0%

20%

36.7%

External 3rd party Audit
Internal different dept. Audit

34.6%

Internal same dept. Audit
Planning to have Audit

33.4%
7.0%

No Audit (No Planning)
Other

40%

18.9%
4.3%
12
© MS&AD InterRisk Research & Consulting, Inc.

3rd Party (Subcontractor) Management

3rd Party (Subcontractor) Management

Security Evaluation at Cloud Service Providers Selection
40.9% of the companies chose “Alternative”.
55.6% for companies with Cybersecurity team chose “Alternative”.
On the other hand, 47.4% for companies without Cybersecurity teamchoose ”No Evaluation” at the moment of Cloud Service Purchase.
In the “Other”, there were answers such as “Guide book by IPA” and etc..
0%

20%

40%

40.9%

Alternative(except ENISA,JNSA, and External
database)

28.2%

External database（CASB,etc.）

2.4%
3.7%
1.2%

ENISA

1.4%
2.5%
0.6%

Questionnaire supervised by JNSA

1.6%
2.1%
0.6%

No Evaluation
ALL(n=624)
With Cybersecurity Team(n=241)
Without Cybersecurity Team(n=323)

Other

60%

19.5%
21.8%
19.9%
22.3%

55.6%

33.7%

47.4%

14

© MS&AD InterRisk Research & Consulting, Inc.

3rd Party (Subcontractor) Management

Security Evaluation at Cloud Service Providers Selection

67.5% of companies with more than 1,001 employees choose “Alternative”, while
17.5% of those companies choose ”No Evaluation”. In addition, companies with morethan 51 employees execute a security assessment and on the other hand, companies
with under 50 employees don’t evaluate.
In the future, we are required to develop a model of the recommended system
configuration including cloud services that can be used safely by enterprises.
0%

ENISA
≦5 employees(n=32)

Questionnaire supervised by JNSA

Alternative(except ENISA,JNSA, and

Other

40%
25.0%

6-20 employees(n=63)

External database（CASB,etc.）

External database)
No Evaluation

20%

80%

31.3%

27.0%
28.6%

21-50 employees(n=92)

34.8%
39.1%

51-100 employees(n=112)

33.9%

101-300 employees(n=172)

45.5%

37.2%
39.0%

301-500 employees(n=64)32.8%

501-1,000 employees(n=49)≧1,001 employees(n=40)

60%

26.5%

17.5%

50.0%
49.0%

67.5%

15

© MS&AD InterRisk Research & Consulting, Inc.

Identify

Identify

Handling status of information assets
With regard to information classifications such as information to be kept
confidential, information limited within the company, information which
can be provided to the confidentiality agreement, publicly available
information and etc. The table below shows the overall response status.
There were 48.2% responded that “We have rules and classifies based onthem.".
Classify information assets
Have documented
rules

1.execute(48.2%)

Not classify information assets

2. not execute(5.1%)

Not have3.plan to
4. no plan to
5. plan to
documented rules document(3.8%) document(7.7%) classify(6.7%)

6. no plan toclassify(28.4%)

17© MS&AD InterRisk Research & Consulting, Inc.

Identify

Issues and vulnerabilities of information assets
We confirmed the management status of the "problem and vulnerability of
information assets" which we possess. 76.7% answered that they are
managing it. Although 32.6% of respondents who answered that they are
managing both issues and vulnerabilities.
0%

ALL(n=628)

20%

40%

32.6%

60%

44.1%

80%

8.6%

100%

14.6%

76.7%
Manage both issues and vulnerabilities

Manage part of issues &/or vulnerabilities

Plan to mange

No manage and no plan18
© MS&AD InterRisk Research & Consulting, Inc.

Identify

Issues and vulnerabilities of information assets
Separate the presence or absence of a company's cybersecurity
team, ”Managing both issues and vulnerabilities” account for 45.6% incompanies with a cybersecurity team, while it is only 22.9% in companies
that do not have a team. There is a big difference depending on thepresence or absence of a cybersecurity team.
0%With Cybersecurity
Team(n=241)
Without Cybersecurity
Team(n=328)

20%

40%

60%

45.6%
22.9%

80%

44.8%

43.3%

10.4%

100%
5.0% 4.6%

23.5%

Manage both issues and vulnerabilities

Manage part of issues &/or vulnerabilities

Plan to mange

No manage and no plan19
© MS&AD InterRisk Research & Consulting, Inc.

Identify
Issues and vulnerabilities in hardware asset management
We confirmed issues and vulnerabilities in hardware asset management.
Overall, 76.5% of companies replied that they are managing (total numberof “Manage both issues and vulnerabilities” and “Manage part of issues &/or
vulnerabilities”).
0%ALL(n=627)

20%

40%

52.5%

60%

80%

34.0%

100%

5.7%7.8%

76.5%Manage both issues and vulnerabilities

Manage part of issues &/or vulnerabilities

Plan to mange

No manage and no plan20
© MS&AD InterRisk Research & Consulting, Inc.

Identify
Issues and vulnerabilities in hardware asset management
By separating the presence or absence of company's cybersecurity team,companies that responded "There is no plan (not planned)" are 2.5% forcompanies with cybersecurity team, while 12.8% for companies without
cybersecurity team which shows there are large differences depending onwhether or not the companies have a cybersecurity team.
0%With Cybersecurity
Team(n=241)
Without Cybersecurity
Team(n=327)

20%

40%

60%

59.8%

45.0%

80%

33.2%

35.2%

100%

4.6%2.5%

7.0% 12.8%

Manage both issues and vulnerabilities

Manage part of issues &/or vulnerabilities

Plan to mange

No manage and no plan21
© MS&AD InterRisk Research & Consulting, Inc.

ProtectProtectBoundary defense between the Internet and its own network(ex. firewall)
We confirmed the implementation status of the boundary defense between
the Internet and its own network. 60.6% of the companies chose “Using
external service or device”.
In the “Other”, there were answers such as “Only subcontractor knows.”
and etc..
0%20%

ALL(n=625)

40%

60%

60.6%

80%

25.8%

100%

2.9% 5.3%
3.8% 1.6%

Using external service or device

Having external service or device but not using

Plan to have

No device and no planNot connect to internet

Other

23
© MS&AD InterRisk Research & Consulting, Inc.

Protect
Rules and formulation of user ID, password and authority forreference and update of information
There are a majority (42.6%) of companies that responded the rules are
documented and inspections and reviews are also being carried out.
In the “Other”, there were answers such as “No rules but check , review
process.”, "conforms to the rule/management of the parent company“ ,and etc..
0%

ALL(n=629)

20%

42.6%

40%

60%

15.4%

8.6%

80%

21.1%

100%

10.5%

1.7%

Documented Rules and check, review process.

Documented Rules and but not check, not review process.

Plan to document rules

Has rules but not documented

No rules and no plan

Other

24
© MS&AD InterRisk Research & Consulting, Inc.

Protect
Rules and formulation of user ID, password and authority forreference and update of information
61.3% for companies with cybersecurity team and 27.4% for companies
without a cybersecurity team, which is more than 33 points away.
0%

20%

With Cybersecurity

61.3%

Team(n=240)

Without Cybersecurity
Team(n=329)

40%

27.4%

13.1%

60%

80%

18.8%

9.7%

29.2%

100%

6.3% 11.3%
0.8%
1.7%

18.2%

2.4%

Documented Rules and check, review process.

Documented Rules and but not check, not review process.

Plan to document rules

Has rules but not documented

No rules and no plan

Other

25
© MS&AD InterRisk Research & Consulting, Inc.

ProtectStatus of antivirus/antimalware software
There are nearly 90% of companies that replied: “installed on all PCs &servers".
In addition, "Other", there was a reply that it is being implemented by thesubcontractor.
0%

20%

40%

60%

80%

100%

4.1%
ALL(n=632)

88.0%

5.2%

0.6%

0.3% 1.7%

Install all PCs and Servers

Install some PCs and Servers, plan to install for all

Install some PCs and Servers, but no plan to install for all

Not installed but plan to install

Not installed and no plan

Other

26
© MS&AD InterRisk Research & Consulting, Inc.

ProtectStatus of updating/monitoring of software(Only install in the previous question)

More than 90% of respondents are ”Update, monitoring and having aprocess when finding vírus, malware & etc.".

0%

20%

40%

60%

80%

90.6%

ALL(n=615)

100%

2.3%

2.9%

4.2%

Updating, Monitoring and having process when find virus, malware & etc.
Having some of process
Plan to have process
Not have and no plan to have27
© MS&AD InterRisk Research & Consulting, Inc.

ProtectStatus of vulnerability management (ex. Windows update)
Considering that ”Implemented & documented management methodology"
and "conducting partly" together, more than 70% of companies aremanaging their vulnerabilities. However, less than 30% of the
respondents are documented their methodologies.

0%

ALL(n=627)

20%

40%

27.9%

60%

43.4%

80%

8.9%

100%

19.8%

Management process is documented and executed

A part of management process is executedPlan to have management process

No plan to have management process28© MS&AD InterRisk Research & Consulting, Inc.

ProtectStatus of vulnerability management (ex. Windows update)Companies with cybersecurity team achieved 43.6% for ”Implemented &documented management methodology” and more than 80% aremanaging vulnerability. On the other hand, 29.6% of companies without acybersecurity team are “No plan to have management process”.
0%

20%

With Cybersecurity

43.6%

Team(n=241)

Without Cybersecurity
Team(n=328)

40%

15.2%

45.7%

60%

80%

100%

41.1%

6.2%

9.5%

29.6%

Management process is documented and executed

A part of management process is executedPlan to have management process

No plan to have management process

9.1%

29
© MS&AD InterRisk Research & Consulting, Inc.

Detect

Detect

Security monitoring systems implementation statusex) IDS and IPS
The largest majority is ”Not implemented and no plan" (35.9%),
then ”Implemented by outsource" (30.5%) comes second.
0%

ALL(n=627)

20%

40%

60%

30.5%

18.8%

Implemented by outsource
Plan to implement

80%

100%

35.9%

14.8%

Implemented and administrate by internal team
Not implmented and no plan to implement

Compare by with or without a cybersecurity team, it is higher for“Implemented by outsourcing“ (40.8%) for companies with cybersecurity
team. But on the other hands, “Not implemented and no plan” (47.4%) isa majority of companies without cybersecurity team.
0%

20%

22.8%

Implemented by outsource
Plan to implement

60%

40.8%

With Cybersecurity Team(n=240)
Without Cybersecurity Team(n=329)

40%

14.3%

24.2%
15.5%

80%

12.9%

100%

22.1%

47.4%

Implemented and administrate by internal team31
Not implmented and no plan to implement© MS&AD InterRisk Research & Consulting, Inc.

Detect
Audit of security monitoring systems and define processes forincidents.
“Both monitoring and reviewing” is a majority (52.6%) of the respondents.
Compare by with or without a cybersecurity team, there is a huge difference(19.0points) between. (With:59.5%, Without:40.5%)
In the “A part of monitoring and reviewing are done”, there were answers
such as “Only Monitoring.”, “conforms to the rule/management of the parent
company“ , and etc..
In the “Other”, there were answers such as “Outsourcing”, and etc..
0%

ALL(n=304)

20%

40%

60%

52.6%

Both Monitoring and Reviewing
Plan to monitoring and/or reviewing

7.9%

80%

100%

14.1%

25.3%

A part of monitoring and reviewing are done
Other
0%

With Cybersecurity Team(n=153)
Without Cybersecurity Team(n=121)

20%

40%

59.5%
40.5%

60%

9.2%
7.4%

29.8%

80%

100%

22.9%

8.5%

22.3%

Both Monitoring and Reviewing

A part of monitoring and reviewing are done

Plan to monitoring and/or reviewing

Other

32
© MS&AD InterRisk Research & Consulting, Inc.

Detect

Policy for system logs
The largest majority is “No Policy and no plan “ (35.7%). But on the otherhands, “Has Policy and Audit & review are done” (27.2%) is in the second
majority.

0%

ALL(n=624)

20%

27.2%

40%

21.0%

60%

16.0%

80%

100%

35.7%

Has Policy and Audit & review are done

Has policy but Audit and review are not done

Plan to make a policy

No ploicy and no plan to have33
© MS&AD InterRisk Research & Consulting, Inc.

Respond & RecoverRespond & RecoverTraining for the security incidents occur
More than half (56.3%) are responded “No practice and no plan”.
In “Other”, we received the answer like; “Order from a parent company”,“Training is conducted by each department.” and so on.

0%ALL(n=629)

20%

14.3%

40%

60%

80%

56.3%

8.3% 8.6% 10.8%

Practice with non-IT dept.

Practice only IT Dept.

Practice has been carried out in somePlan to have practiceNo practice and No Plan

Other

100%

1.7%

35
© MS&AD InterRisk Research & Consulting, Inc.

Respond & RecoverTraining for the security incidents occur
Compare by have or don’t have had security incidents, More than 40% ofcompanies , have had security incidents, choose “No practice and No Plan”.
0%

Have had security
incidents(n=139)

20%

20.9%

40%

10.1% 7.2%

60%

15.8%

80%

100%

45.3%

0.7%

Don't have had
security
incidents(n=410)

11.5%

8.0% 10.5%

9.5%

58.8%

Practice with non-IT dept.

Practice only IT Dept.

Practice has been carried out in somePlan to have practiceNo practice and No Plan

Other

1.7%

36
© MS&AD InterRisk Research & Consulting, Inc.

Respond & RecoverTraining for the security incidents occur
It is higher for “Practice with non-IT dept.“ (23.2%) for companies withcybersecurity team. But on the other hands, “No practice and No Plan”(72.3%) is a majority of companies without cybersecurity team.
In companies with cybersecurity team, the detection of alerts while
protecting cyber security can lead to accident detection and response, and it
is considered that accidents, including minor accidents, can be dealt with ata time when the scope of impact is small while judging the situation. For
companies that do not have cybersecurity team or have a small workforce, itis necessary to outsource the ability to handle potential cybersecurity
incidents when the impact is small.
0%With Cybersecurity Team(n=241)
Without Cybersecurity Team(n=328)

20%

23.2%

40%
12.0%

12.0%

8.5%5.5% 7.6%
4.6%

60%
15.4%

80%

100%

35.7%

1.7%

72.3%

Practice with non-IT dept.

Practice only IT Dept.

Practice has been carried out in somePlan to have practiceNo practice and No Plan

Other

1.5%

37

© MS&AD InterRisk Research & Consulting, Inc.

Respond & Recover

Review of “Training for the security incidents occur”
73.0% of respondents are ”Look back practice and reviewing for nexttime”. And including who has the plan to review, it is close to 90%. It
means most of the companies who have practice/training arereviewing/plan to review.
In “Other”, we received the answer like;” Training is conducted by theparent company“、”We don't feel the need to review the training.“and so
on.
0%

20%

ALL(n=141)

40%

60%

73.0%

80%

15.6%

Look back practice and reviewing for next time

Plan to reviewing for next time,

No reviewing and no plan

Other

100%

7.8%

3.5%

38
© MS&AD InterRisk Research & Consulting, Inc.

Security incidents

Security incidents

Occurrence of cyber security incidents
Answering to the question that they had a cybersecurity incident in thepast, 22.2% of companies said "Yes".
13.1% of companies without a cybersecurity team answered as “No notknow”. They might not be aware of security incidents.
0%
ALL(n=627)

20%

40%

22.2%
Yes

60%

80%

65.4%
No

Do not know

0%

20%

With Cybersecurity Team(n=241)

Without Cybersecurity Team(n=327)

DO not want to answer
60%
65.6%

20.8%

Yes

9.6% 2.9%

40%

24.9%

No

100%

80%

100%
5.8%

63.6%

13.1%

Do not know

DO not want to answer

3.7%

2.4%
40

© MS&AD InterRisk Research & Consulting, Inc.

Security incidents

Occurrence of cyber security incidents
The result of research for enterprises with 1,001 or more is clearly small(2.5%) for “Do not know.", while the same for less than 1,000 employees
enterprises are very high.
0%≦ 5 employees(n=31)
6-20 employees(n=61)

20%

40%

21-50 employees(n=95)

15.8%

51-100 employees(n=114)

18.4%

4.2%2.1%
14.0% 1.8%
11.0% 4.0%

59.0%

51.0%
47.5%

42.5%
No

10.9%1.6%

57.8%

34.7%

Yes

9.8% 1.6%

65.8%

29.7%

≧ 1,001 employees(n=40)

6.5%0.0%

77.9%

26.0%

501-1,000 employees(n=49)

100%

85.2%

3.3%

301-500 employees(n=64)

80%

83.9%

9.7%

101-300 employees(n=173)

60%

Do not know

10.2%4.1%

2.5% 7.5%

DO not want to answer

41© MS&AD InterRisk Research & Consulting, Inc.

Security incidents

Details of the most serious incident
What caused the biggest damage by the cyber incidents are as follows:
1st: Malware (48.9%), 2nd: unauthorized access (17.3%) and3rd: Targeted attack (12.2%).
In “Other”, we received the answer like; ”inside job“, ”Business E-mailCompromise (BEC)“ and so on.
DO not(n=139)want toanswer,5.0%
Do notknow,

other,
12.9%

3.6%

Targeted
attack,12.2%

malware, 48.9%unauthor
ized
access,17.3%
42© MS&AD InterRisk Research & Consulting, Inc.

Security incidents

maximum amount of damage
When we confirmed the amount of damage from the most serious incident,
the results were as follows:
1st: under 1million JPY (52.9%), 2nd: 1 million to 10 million JPY (9.6%),
and 3rd: 10 million yen or more (1.5%).
(n=136)

DO not wantto answer,
8.1%

Do not know,<1million

27.9%

JPY, 52.9%

1 million JPY≧10 million
JPY, 1.5%

to less than
10 million
JPY, 9.6%
43© MS&AD InterRisk Research & Consulting, Inc.

Security incidents

Reason for recognizing the incident“How the enterprise recognized the accident?”.
The results were as follows:
1st: Internal Report (65.1%), 2nd: External Inquiries (12.7%), and3rd: From subcontractor (9.5%).
“Other” contains ”System detection“, ”Parent company’s report“ and so on.
DO not want to(n=126)answer, 1.6%
Do not know,

other,

0.8%

10.3%

Internal
From

External

subcontractor,

Inquiries,

9.5%

12.7%

Report,65.1%

44© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

Cyber insurance

Status of cyber insurance & data breach insurance“Not have and no plan” achieved more than 70% for both insurances. It isonly 14.6% for cyber insurance and 16.4% for data breach insurance whohave a policy.

0%

Cyber Insurance(n=622)

Data breach insurance(n=621)

20%

40%

60%

80%

14.6% 10.5%

74.9%

16.4%

74.6%

9.0%

Have PolicyPlan to have100%

No have and no plan46
© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

Status of cyber insurance & data breach insurance
Compare by with or without of cybersecurity team, it is 20.3% “withcybersecurity team” who has cyber insurance policy which is 9.0% “without”.
(More than two times). For data breach insurance, the situation seems thesame as “with” is 22.6% and “without” is 10.8%.
0%With Cybersecurity Team/Cyber
Insurance(n=241)
With Cybersecurity Team/Data breachinsurance(n=239)
Without Cybersecurity Team/Cyber
Insurance(n=323)
Without Cybersecurity Team/Databreach insurance(n=324)

20%

20.3%
22.6%

40%

60%

12.4%

10.9%

66.5%

83.3%

10.8%6.2%

83.0%
Plan to have

100%

67.2%

9.0%7.7%

Have Policy80%

No have and no plan47
© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

The reason who have policy *multiple answer
The most common reason for buying insurance was “Coverage ”（Cyber
Insurance：60.0%、Data breach Insurance：66.7%）。
“Other” contains “blanket insurance”, “Request from the parent company
and/or head office”, and etc..

0%

Cyber Insurance(n=90)

Data breach Insurance(n=99)

20%

40%

33.3%
28.9%

60%

80%

60.0%

Premium

14.4%
8.9%
20.0%

11.1%
9.1%
14.1%

39.4%
31.3%

Coverage

Insured amount

66.7%

Request from business
partners
Additional insurance
services
Other
48© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

The reason who don’t have policy *multiple answer
The Majority is “Didn‘t know about the insurance” (Cyber insurance:
30.7%, Data breach insurance: 30.5%) and the reason is not by“Expensive premium”.
0%

20%

40%

22.6%
Cyber Insurance(n=430)
7.9%

14.2%
14.4%

30.7%
29.5%

7.9%

14.7%
14.5%

Never offered
No needs

30.5%
Data breach Insurance(n=429)

Didn't know

23.8%
27.3%

Don't know detail about
insurance
Expensive Premium
Other

49
© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

The reason who don’t have policy *multiple answer

While the majority of companies that have experienced security incidents
said, “Didn't know“” (Cyber insurance:31.3% and Data breachinsurance:33.0%), the majority of companies that have not experienced
security incidents said, “No needs" ” (Cyber insurance:31.7% and Databreach insurance:30.0%).0%
20%
40%
Cyber
Insurance

Have had security
incidents(n=96)

31.3%

11.5%
16.7%
7.3%

Don't have had security
incidents(n=281)

8.5%
0%

Data breachInsurance

Have had security
incidents(n=100)

20.6%
14.9%
14.6%

Don't know detail about insurance

29.9%

31.7%

Expensive Premium
Other

40%

25.0%
21.0%

33.0%

12.0%
18.0%
7.0%

15.8%
14.3%

Didn't know
Never offered
No needs

29.3%
22.0%
8.1%

Never offered
No needs

20%

Don't have had security
incidents(n=273)

24.0%
25.0%

Didn't know

Don't know detail about insurance

30.0%

Expensive Premium
Other

50

© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

Required coverage *multiple answer
The majority of the answer is “Liability (62.6%)” and for the second,“Cost for recovery(59.1%) ” .
In the “Other”, there were answers such as ” Expenses paid to lawyers
who provided support for the handling of the mass media”,and etc..
0%(n=623)20%

40%

Cost for recovery

59.1%

Cost for replacement

33.2%

Business interruption

Nothing to require

80%

62.6%

Liability

Other

60%

21.7%
1.6%
23.9%
51
© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

Expectations for additional insurance services(1/2)
When we checked expectations for additional insurance services, the results
were as follows: 1st: Call center (82.4%), 2nd: Emergency service(77.9%) and 3rd: Vulnerability diagnosis (77.5%).
0%20%

structure(n=612)
Asset Management Assistance(n=612)
Support for drafting documents andregulations(n=611)

29.2%

24.8%

Security Diagnostic Service(n=611)

41.2%

33.4%
19.0%
15.4%

Very important

33.3%

12.2%

9.9%

16.3%

18.5%

31.7%

quite important

9.5%

12.1% 11.8%
29.2%

39.9%

100%

8.3%

17.6%

42.7%

32.4%

23.9%

80%

23.1%

48.7%

Emergency service(n=614)

Support for establishment of organizational

60%

59.1%

Call center(n=611)

Security device with cyber Insurance(n=612)

40%

20.6%

21.3%

not very important

14.9%

not at all important52© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

Expectations for additional insurance services(2/2)“Other” contains ”Support for acquisition of certification”, ”Introduce lawyers
who are knowledgeable about security issues ” , ”On-site inspection until
recover” and etc..
0%

20%

40%

35.3%

Vulnerability diagnosis(n=612)
Provision of intelligence information from Dark Web,

20.0%

etc.(n=610)
Package services for defense, detection, and initial
respond to incidents(n=613)
Support for establishing an initial response system in theevent of an accident and initial response training(n=613)

42.2%
44.4%

100%

10.3% 12.3%
20.8%

14.8%

42.9%

17.8% 13.4%

24.1%

47.8%

16.5% 11.6%

13.4%

Introduce business operator for forensic(n=611)

17.7%

Very important

80%

25.9%

Introduce security vendors(n=610)

Other(n=12)

60%

36.2%

41.7%
quite important

30.8%

43.5%

19.5%

25.0%
58.3%

not very important

13.7%
0.0%

not at all important53© MS&AD InterRisk Research & Consulting, Inc.

Questionnaire

Cost, Liability,
Introduce Cyber
Vender etc.

ScoringGlobal Company

Forensics

Intelligence Report

CSIRT Class

Training for Media

Endpoint Security

Organization Dev
for Cyber Incident

Web Analysis

Exit Measures

Respond Seminar

Target Attack e-mail training

SMBs

Risk Consulting

Insurance

Cybersecurity・MS&AD Platform

Information Security analysis

Web Analysis

Exit Measures

Cybersecurity
Framework

Under co-researchwith Lucideus Inc.

Internal
Management
Organization•••

PolicyCyber Team
Budget &Resources

Identification ofCyber Risk oforganization andmap as ERM[Security Policy..]

External
Management•

External
contract andmanagement

Supply chain andOutsource control& management[Template of
NDA & Contract]

Risk Identify•

Validation ofAsset tracking

Under co-researchwith BEworks Inc.

Protect••••

Risk assessment
include evaluation[Asset list, Risk
evaluation sheet]

Respond Seminar

FirewallAccessManagement
Anti-Malware
Etc.

Detect••Monitoring andlog
management
Etc.

Plan for the implementation ofremediation the prioritized by Risk
assessment. And monitoring process.
[Procedure of Cybersecurity
monitoring]Respond &Recover••Training
Respondaction andrecovery etc.

Recoverydocuments andreview by practices[Recovery
procedure & etc.]© MS&AD InterRisk Research & Consulting, Inc.

MS&AD InterRisk Research & Consulting, Inc.
Cyber Risk Sec.

WATERRAS ANNEX,2-105,Kanda Awajicho,
Chiyoda-ku, Tokyo 101-0063
Tel：+813-5296-8961／Fax：+813-5296-8940
https://www.irric.co.jp/© MS&AD InterRisk Research & Consulting, Inc.