3. Information Protection and Management(1) Basic Approach
As utilization of IT has become essential to increasing the profitability of many business corporations,such corporations are facing a growing exposure to increasing and ever more sophisticated cyberattacks
aiming to access personal information of customers and important technology information held by thecorporations. It is becoming ever more important for corporations to appropriately manage and protect
corporate information, including personal information, as part of their social responsibility. The Hitachi
Metals Group established the “Basic Policy of Information Security” in April 2004, followed by the“Personal Information Protection Policy” in January 2005, establishing an organization of personal
information protection/information security based on these policies. The Company has continued toupdate information security measures in line with these policies.
Basic concept of information asset protection >>Clarify assets to be protected●Determine information assets and analyze risks

Employee Education●Prepare security-related teaching materials●Provide instructions for managers and employees

Information assets
to be protected

Prepare measures●Fully implement measures from an informationmanagement perspective●Introduce measures from a technology perspective

Establish information-security organization●Prepare rule system (security policy)●Prepare management system●Establish audit and follow-up structure●Fully review feedback through enhanced PDCA cycle as applied toprevention and incident response processes

In January 2016, private companies along with local governments and other organizations across Japanbegan using the My Number system, a social security and tax information system for individuals. At
corporations, human resources and general administration departments deal with employees’ My
Number information, legal departments handle investors’ My Number information, and procurement
departments collect My Number data on sole proprietors. Consequently, the My Number launch
precipitated the need to amend personal information protection policy along with regulations on themanagement of personal information as well as peripheral rules, detailed regulations, guidelines, andother administrative formalities. However, personal information, including that of the My Number system,
is a valuable asset that companies must manage and safeguard. To date, Hitachi Metals has applied a
two-pillared approach—rules pertaining to information security that hinged on the Basic Policy forInformation Security and rules pertaining to the management of personal information that hinged on thePersonal Information Protection Policy. Two corporate structures—the Personal Information ProtectionCommittee and the Information Security Committee—worked as one to expediently promote measures.
Consequently, the introduction of My Number provided an opportunity to implement a system with a19
Hitachi Metals Group CSR Detailed Activity Report 2022

single set of rules and to integrate the corporate structures as well.
In December 2015, Hitachi Metals unified existing rules related to information security and rules related
to the management of personal information along with rules related to the handling of confidential
documents, and then merged them into rules related to information security, which are the mainstay of
information security management rules.
Hitachi Metals’ efforts to enhance information security are driven by four considerations: 1) establish an
information security organization, 2) clarify assets to be protected, 3) educate employees, and 4)
maintain various security measures. The Company works steadily to implement steps to achieve eachone. Particular emphasis, however, is placed on prevention, responding quickly if a situation arises,
heightening employees’ sense of ethics, and making them more security conscious. In addition, Hitachi,Ltd. leads the Hitachi Group, of which Hitachi Metals is a part, in promoting information security
management and working toward a higher level of security throughout the wider group organization.

(2) Promotion Organization
Following the integration of related rules in December 2015, the Personal Information Protection
Committee and the Information Security Committee were reorganized into a new Information Security
Committee. To reinforce the Information Security Committee, a Cybersecurity Manager was appointed in2017 to address the growing threats of cyberattacks, and a Privacy Protection Manager appointed in2020 to cope with privacy-related risk and compliance issues.

20
Hitachi Metals Group CSR Detailed Activity Report 2022

(3) Information System Security Measures
Hitachi Metals has systematically implemented measures against external risks such as targeted attacks
and other unauthorized access and computer viruses, internal risks such as the unauthorized removal,
loss, or theft of company information or the sending of e-mails to unintended recipients, and other risks
including natural disasters, etc.
Since fiscal 2006, the Company has been continuously inspecting the personal computers of employees
who have a Group e-mail address to find and delete business information, and this was done again in
fiscal 2020. At the same time, the Company instructed its employees to submit, through the website, awritten pledge not to retain business information in personal computers and other devices which theyown. Since fiscal 2007, the Company has also requested that its business partners deploy equivalentmeasures to prevent leaks of business information from personal computers owned by their employees.
Since fiscal 2009, we have introduced a filtering system to monitor all e-mails sent externally to prevent
external leaks of business information. Further efforts have also been made to enhance measures
preventing information leaks, such as reviewing and improving our management system for portable
information terminals to prevent losses of increasingly capable mobile phones, smartphones, and otherdevices. In addition, as a countermeasure against the sending of e-mails to unintended recipients,
erroneous transmission prevention software has been installed on all business PCs of the Hitachi MetalsGroup.
As countermeasures against cyberattacks, quarantine programs were introduced in 2018 to increasecapabilities to address the vulnerability of company computers, and Endpoint Detection and Response(EDR) software was introduced in 2020 to improve endpoint security.
Despite these measures, in the Hitachi Metals Group in fiscal 2020, some e-mails were sent tounintended recipients. Nevertheless, there were no incidents involving breach of customer privacy orleakage of customer information.

(4) Employee Education
Each year, the Company provides information security education for all employees (including temporarystaff, etc.) who use IT equipment. This education is designed to instill an understanding of rules related
to the use of IT equipment, including the handling of information (including personal information) and theprohibition against using personal computers for work. The education has been provided in the elearning format since fiscal 2020 to replace the previous on-site visits, as a measure to control COVID19 infection. In order to improve capabilities to protect from targeted e-mail attacks, which have been
becoming ever more sophisticated and posing a growing threat of malware infection, relevant training is
run on an ongoing basis to raise the security awareness of individual employees.

21Hitachi Metals Group CSR Detailed Activity Report 2022

e-learning training in Japan and overseas*Conducted using materials in PDF format at
business sites where e-learning training was not

Training using simulated e-mails about targeted attacks

available.
Implementation

August 2021–March 2022

January–February 2022

timingEmployees at business sites connected to theTarget

Hitachi Metals Group employees
Hitachi Metals Group network(5) Self-audit
Each year, the Company conducts a self-audit of personal information protection/information security,
confirming the status of compliance with the rules, and improving any areas that need to be addressed.
Our fiscal 2021 audit was performed between December 2021 and January 2022.

(6) Protection and Respect for Intellectual Property
Hitachi Metals practices the principle set forth in its Codes of Conduct that reads: “We will protect ourown intellectual property, respect third-party intellectual property, and use both effectively for smoothbusiness operations.”
Specifically, to appropriately protect and effectively apply intellectual property created in such processes
as research, development, and manufacturing, Hitachi Metals acquires the rights to inventions, ideas
and designs created by employees in the course of their work, in accordance with the Company’s rules,
which have been established through legally stipulated procedures. With the global expansion of ourbusiness, we acquire and maintain the rights to these creations as intellectual property rights inside andoutside Japan, forming assets that will support the sustainable growth of the Hitachi Metals Group. We
take appropriate action against infringements of our intellectual property rights, including exercise of ourrights through legal action.
At the same time, we strive to prevent infringements of the intellectual property rights of others andsmoothly advance our business. To that end, we investigate the intellectual property rights of others
globally, in advance of all stages of research, development, design, etc., for new products andtechnologies, in accordance with Hitachi Metals rules. If that investigation reveals a need to use theintellectual property rights of others, we acquire the necessary licenses.
We also provide our employees with ongoing education and training about intellectual property, to instillawareness of the protection and respect of our intellectual property rights and those of others.

22Hitachi Metals Group CSR Detailed Activity Report 2022