Research of SMB’s
Cybersecurity measures inJapan 2020

Introduction.
The number of cyber-attacks has been increasing year by year. In addition, the modus operandi
and methods of attacks targeting companies and organizations are becoming more sophisticatedand sophisticated, and there are cases of serious consequences. Cyber security is an important issue
for companies and organizations, and if they fail to take appropriate measures and incur significant
damages, they may be held liable for management and legal liabilities. In addition, the promotionof management reform and innovation using IT and the reform of work styles such as WFH, which
many companies have started to implement, requires an ICT environment that can be used safely
and securely, and cyber attacks threaten this premise.
In other words, it can be said that taking cyber security measures is an important issue thatcannot be avoided in corporate management.
Every year, we conduct a survey on the current status and trends of corporate cyber security,
including cyber security measures, damage status and issues, with the aim of contributing to the
reduction of cyber security risks in the future. This year, we have added questions on security
issues related to WFH (Work From Home) and other new normal ways of working, and theimplementation status of measures.
We hope that this survey will help companies to take further action.

© MS&AD InterRisk Research & Consulting, Inc.

Results and recommendations of this study
The actual situation revealed by this survey and the recommendations based on it are as follows.
①

Launching theEstablishing a cyber security system is the first step of cyberorganization
security measures.
Lessons andCompanies that have established a cyber security system
LearnsDeveloping(hereinafter referred to as "organizational system") have relatively
documents andregulations
better results in cyber security measures. The improvement
Networking withactivities are initiated by establishing an organizational structure.
outside② Steady maintenance of documents and regulations
Measures/Responses
In addition to the development of the organizational structure, it
was also confirmed that it is important to develop the documents
and regulations from policies (policies and action guidelines) toSelf Clarification
standards (standards and standards) to procedures (procedures) in amore practical manner in order to take security measures.
③ Be aware of the cyber risks of the new normal way of working.
It was found that companies without an organizational structure were less likely to recognize the challenges of WFH
and/or to review targeted e-mail training.
④ Vulnerability management is handled by the organization based on the level of importance.
Compared to the results of last year's survey, we found that vulnerability management in enterprises has notprogressed. It is necessary to identify the vulnerabilities that truly need to be addressed and take efficient action.
⑤ Consider the need for insurance, including additional services.
Although the participation rate of cyber insurance is still not high, the results show that the awareness of cyber
insurance itself is gradually increasing. In addition, many companies that do not have cyber insurance cited "apackage service that covers protection, detection, and initial response in case of an incident" as an expectedsupplementary service. It is recommended to consider the necessity of cyber insurance as well as supplementary
services.

© MS&AD InterRisk Research & Consulting, Inc.

Survey Summary

Survey on cyber security and cyber insurance

Outline of Research
Survey Method

Mailing Questionnaire (combined with web-based
response)
10,000 companies in Japan

Target companies

Extracted from Toyo Keizai Inc.'s "40,000 company data in Japan ((1)
Basic data)"
Companies that randomly extracted in industry by industry

Number of valid responses

557 (total collected number: 563)
Recovery rate 5.5%

Survey period

November 18 - Dececember 4, 2020.

4© MS&AD InterRisk Research & Consulting, Inc.

Survey on cyber security and cyber insurance

Industry and size of responding companies
Industry（n=557)
Accomodation

Energy1%2%Mining0%

Real estate2%

Retail6%

Number of employees（n=557）

Manufacture

Transportation

29%

7%

Less than 5ConstructionMore than

8%

1,001

IT, Telecom
9%
Finance,Insurance
10%

501 to 1,000
Services
13%

Wholesale

12%4%
6 to 20
11%

8%

13%

21 to 50301 to 500

14%

9%

51 to 100
101 to 300

14%

28%

5
© MS&AD InterRisk Research & Consulting, Inc.

Internal management system

Internal management system

Cyber security system in place* Multiple choices (1/2)

Half of the respondent companies had not established a cyber security system, andamong the companies that answered that they had a cyber security system, "CISO" wasthe most commonly established.
(n=550)41.1%.

SOC

CSIRT

CISO

0%

There are20%

Chief Information Security Officer
A position that oversees and manages theorganization's information security.
Its main roles are to formulate security policies,
lead the response to security incidents, bridge
information security-related issues to the
management, and manage information security
within the organization.
Computer Security Incident Response TeamA n org a n iza tio n t hat r e spo nd s t o cyb e r
security-related incidents such as information
leaks and system failures caused by cyberattacks. It also conducts research and otheractivities during normal times, not just during
incidents (emergencies).
Security Operation Center
An organization that monitors and analyzes thelogs generated by information security devices,servers, and computer networks to detect andnotify cyber attacks. There are two types of
SOCs: those that m o n i t o r t h e i r o w norganizations and those that provide services tomonitor their customers.

No.

40%

0.0%

50.2%.

8.7%.

Other

60%
10.0%

80%

20.0%

30.0%

CSIRT

Other

ない

40.0%

50.0%

60.0%

28.0%

CISO

SOC

100%

19.5%

15.1%

11.5%

50.2%
7
© MS&AD InterRisk Research & Consulting, Inc.

Internal management system

Cyber security system in place* Multiple choices (2/2)

Furthermore, by the number of employees, "CSIRT" and "SOC" (43.9% each) were
established most frequently in companies with 1,000 or more employees, suggestingthat company size (employee size) is related to the establishment of organizational
systems. In addition, "PSIRT" was mentioned for the first time since the start of thissurvey in companies that selected "Other.
The reasons given by companies that chose "no" were lack of human resources, lack ofknowledge and skills, and lack of understanding on the part of management.
PSIRT

Product Security Incident Response TeamAn organization that addresses the risks arising from vulnerabilities in the products offered by the organization.
Conducts activities to address vulnerabilities in its products and to manage and improve the security quality of its
products.

60.0%
50.0%
40.0%
30.0%

43.9%

49.6%

43.9%
33.3%

27.6%

25.8%
19.2%

20.0%

14.9%

11.3%

16.7%

10.0%
0.0%

CISO

CSIRT

Full Body(n=550)

SOC

Other

More than 1,001(n=66)

NO

8© MS&AD InterRisk Research & Consulting, Inc.

Internal management system

Documents and regulations related to security that are in place*
Multiple choices (1/2)

The most common document/regulation related to security was the "Policy" (63.5%).
Overall, there was a difference depending on the existence of organizational structure.
For companies that selected "Other," "In line with the rules of the groupcompany/parent company/head office" and "Included in the company rules such as
employment regulations" were the most common responses.
The reasons given by companies that chose "no" included "lack of knowledge" and "lackof human resources.
100.0%
80.0%

86.7%

63.5%

60.0%

45.3%

67.3%
47.3%

45.8%

40.0%

28.1%

35.2%

28.7%

31.4%

26.3%

17.7%

13.5%

20.0%
0.0%

47.8%

PolicyStandard

Procedure

Full Body(n=554)

Guideline

4.3%1.8%4.0%

2.2%

Other

No documents

With Cybersecurity team(n=226)

Without Cybersecurity team(n=274)
9© MS&AD InterRisk Research & Consulting, Inc.

Internal management system

Documents and regulations related to security that are in place*
Multiple choices (2/2)

The status of security-related documents and regulations was categorized into fivelevels, as shown below, assuming that they are developed from policies to standards toprocedures to guidelines.
16.8%

10.3%

9.2%

15.5%

20%

30%

40%

Level1

Level2

Level3

48.2%

Full Body(n=554)

51.8%
0%

10%

50%

60%

Level4

70%

80%

90%

100%

Other

Policystandard

Procedure

Guidelines

Level 1

Done

N/A

N/A

N/A

Level 2

Done

Done

N/A

N/A

Level 3

Done

Done

Done

N/A

Level 4

Done

Done

Done

Done

Other

All items that do not fall under Levels 1 through 4
10© MS&AD InterRisk Research & Consulting, Inc.

Internal management system

Whether or not the described contents are implemented/audited.
(Only if you answered "Yes" to the previous question)

Of the companies that responded that they have documents and regulations, we asked
whether they check or audit whether the contents described in the documents andregulations regarding security are being implemented. The most common answer(38.8%) was “Internal same dept. Audit". Compared to the last year's survey, thenumber of respondents who answered "No Audit(no planning)" decreased, suggestingthat the system has been improved.
0.0%

5.0%

10.0%

15.0%

20.0%

25.0%

30.0%

Internal same dept. Audit

33.4%
30.5%

Internal different dept. Audit

45.0%

38.8%

34.6%

7.9%
7.0%

12.3%

No Audit (No Planning)
Other

40.0%

35.3%
36.7%

External 3rd party Audit
Planning to have Audit

35.0%

18.9%

5.5%
4.3%

2020(n=456)

2019(n=488)
11© MS&AD InterRisk Research & Consulting, Inc.

Internal management system

Challenges in implementing WFH* Multiple choices
We surveyed the challenges of WFH by type of WFH implementation ("work equivalent
to own office" and "work limited to a part"). When we checked the responses by theexistence of an organizational structure, a higher percentage of companies without anorganizational structure responded that there were "no issues" than companies with anorganizational structure in any WFH format.
In situations where control by the organization is not sufficient, it is possible that"issues are not recognized as issues.
0%

20%

40%

work equivalent to own office（With Cybersecurity team)(n=95)

work equivalent to own office（Without Cybersecurity team)(n=89)

81.1%

65.2%

60%

80%

100%

18.9%
34.8%

work limited to a part(With Cybersecurity team)(n=129)

85.3%

14.7%

work limited to a part(Without Cybersecurity team)(n=171)

81.3%

18.7%

There is some issue

no issues
12© MS&AD InterRisk Research & Consulting, Inc.

Internal management system

Challenges in implementing WFH* Multiple choices

When the issues were checked in detail, the number of companies without anorganizational structure was lower than that of companies with an organizational
structure for "Inability to print and stamp documents”.
Conducting business without adequate controls and without recognizing risks canincrease the possibility of information leaks. It is once again important to establish anorganizational structure to resolve the issues.
0.0%

10.0%

20.0%

20.0%
23.6%

No Documents and regulations regarding WFH
security
11.6%
9.0%

No regulations regarding BYOD security
VPN has not been introduced

30.0%

2.1%
4.5%

18.6%

40.0%
34.1%

The urgently prepared WFH environment has become
the internal standard as it is.

60.0%

70.0%

51.5%

32.2%

19.4%
18.1%

41.6%

Inability to print and stamp documents
Insufficient endpoint security measures

50.0%

10.5%

62.1%
53.2%

62.0%

20.2%
25.6%
29.8%
17.9%
14.6%
23.3%
21.1%

work equivalent to own office（With Cybersecurity team)(n=95)
work equivalent to own office（Without Cybersecurity team)(n=89)
work limited to a part(With Cybersecurity team)(n=129)
work limited to a part(Without Cybersecurity team)(n=171)

13© MS&AD InterRisk Research & Consulting, Inc.

External management system

External management system

Implementation status of security assessment and evaluation for
selecting cloud service providers (1/2)

We checked whether or not security is evaluated when selecting a cloud service
provider. Compared to the last year's survey, the percentage of respondents who
answered "yes" to the question increased. One reason may be that WFH and otherfactors have necessitated the migration of internal assets to cloud services, and eachcompany has established a system to conduct evaluations.

0.0%

10.0%

20.0%

30.0%

40.0%

60.0%

70.0%

58.0%

Yes

No

50.0%

46.3%

27.2%
33.7%

FY2020(n=548)

FY2019(n=642)

15© MS&AD InterRisk Research & Consulting, Inc.

External management system

Implementation status of security assessment and evaluation for
selecting cloud service providers (2/2)

Guide by IPA was the most common choice in the questionnaire (11.3%), regardless ofwhether there was an organizational structure, while “No evaluation" was the mostcommon choice (38.2%) among companies without an organizational structure.
It was confirmed and is expected that the security measures for the use of cloudservices, which will be increasingly expanded in the future, will be "modeled as arecommended system configuration including cloud services that enterprises can use
with confidence" based on policies and demonstrations.
0.0%
Guide of ENISA
Questionnaire supervised by JNSA
External database（CASB,etc.）
Guide by IPA
CloudControlMatrix by CSA

10.0%

1.8%
0.4%
2.0%
0.7%
2.9%
1.5%
7.5%
0.9%
0.0%

20.0%

2.7%

11.3%

17.7%

Other

Full body(n=548)

50.0%

team(n=226)
Wihtout Cybersecurityteam(n=267)

2.2%

Alternative(except ENISA,JNSA,External database,IPA and CSA)
No evaluation

40.0%

With CyberSecurity

4.0%
4.9%

30.0%

34.5%
27.2%

15.0%
17.3%
19.1%

19.5%

39.1%
44.2%

38.2%
16

© MS&AD InterRisk Research & Consulting, Inc.

Identify

Identify

Status of handling of information assets in possession
We asked the respondents whether they categorized the scope of information
disclosure for the information assets they possess (e.g., information that should be kept
confidential, information that is limited to internal use, information that can be provided
to parties with whom they have concluded nondisclosure agreements, and informationthat can be made public). The overall response status is shown in the table below.
Although the largest number of companies (46.8%) answered that they "have journal
rules (documented) and classify according to those rules" (option 1.), less than half ofthe companies were able to do so.
Classify Information assets

Documented
Rules

Have

1. Executing(46.8%)

2. Not Executing(6.6%)

Not
have

3. Planned to
be documented(2.0%)

4. Not planned
to bedocumented(8.2%)

Not classify Information assets

5. Planned to
be classified(7.7%)

6. Not planned
to be classified(28.8%)
18© MS&AD InterRisk Research & Consulting, Inc.

Identify

Issues and vulnerabilities of information assets held (1/2)(e.g., keeping confidential information where anyone can see it, not encrypting passwords, etc.)

We asked about the status of the management of issues and vulnerabilities of theinformation assets they own. Overall, only 31.9% of the respondents answered that they
are managing both issues and vulnerabilities.

Full

31.9%

Body(n=555)

0%

20%

9.2%

42.0%

40%

60%

80%

16.9%

100%

Manage both issues and vulnerabilities

Manage part of issues &/or vulnerabilities

Plan to mange

No manage and no plan19
© MS&AD InterRisk Research & Consulting, Inc.

Identify

Issues and vulnerabilities of information assets held (2/2)(e.g., keeping confidential information where anyone can see it, not encrypting passwords, etc.)

When this question is broken down by the presence or absence of a corporate cybersecurity team, 46.9% of the companies with Cybersecurity team answered that they
“manage both issues and vulnerabilities," while only 17.9% of the companies without ateam, indicating a large difference depending on the presence or absence of a system.
0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

6.2%

46.9%

With Cybersecurity team(n=226)

Without Cybersecurity team(n=274)

17.9%

40.3%

42.7%

13.5%

6.6%

25.9%

Manage both issues and vulnerabilities

Manage part of issues &/or vulnerabilities

Plan to mange

No manage and no plan20
© MS&AD InterRisk Research & Consulting, Inc.

Identify

Challenges and vulnerabilities in hardware asset management ofowned IT devices (1/2)(e.g., not knowing where and by whom deployed PCs are managed, and not realizing that PCs are lost)

We checked the issues in hardware asset management of IT devices and the status ofvulnerability management.
Overall, 51.5% of the respondents answered that they are managing both issues andvulnerabilities, but nearly half (48.5%) of the total respondents answered that they are"partially managing", "planning to manage", and "not managing (or have no plan)". This
indicates that nearly half of the companies (48.5%) are not sufficiently managing
vulnerabilities.
7.4%

51.5%

Full Body(n=555)

0%

20%

Manage both issues and vulnerabilities
planning to manage

29.9%

40%

60%

11.2%

48.5

80%

100%

partially managing
not managing (or have no plan)21© MS&AD InterRisk Research & Consulting, Inc.

Identify

Issues and vulnerabilities in hardware asset management ofowned IT devices (2/2)(e.g., not knowing where and by whom deployed PCs are managed, and not realizing that PCs are lost)

When this question was divided into the presence or absence of a corporate cybersecurity system, 63.3% of the companies with a cyber security system answered"managed" while 38.7% of the companies without a system, showing a large difference
depending on the presence or absence of a system.
0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

With
With
organization
Cybersecurity
systemteam(n=226)(n=226)
No
Without
organization
Cybersecurity
systemteam(n=274)(n=274)

63.3%.

38.7%.

28.3%.

32.8%.

9.9%.

Issues and vulnerabilities are managed.
Some of the issues/vulnerabilities are managed.
Planning to manage issues/vulnerabilities
No issues/vulnerabilities are managed (no plan)

6.2%. 2.2%.

18.6%.

22© MS&AD InterRisk Research & Consulting, Inc.

Identify

Management status for vulnerabilities (1/2)(e.g., vulnerabilities in Windows, Adobe Flash, etc.)

We asked the respondents whether they manage the vulnerability of PCs and software.
More than 70% of the companies had a documented management system in place lastyear, but this year, the figure was less than 70%. In addition, less than 30% of thecompanies have documented their practices.
0%

FY2020(n=553)

10%

20%

30%

40%

25.5%.

50%

37.6%.

60%

70%

80%

10.5%.

90%

100%

26.4%.

63.1
FY2019(n=627)

27.9%.

43.4%.

8.9%.

19.8%.

71.3

The management method is defined (documented) and implemented.
Partially implemented.
Have a plan to manage it in the future.
Not managed (and no plan)23© MS&AD InterRisk Research & Consulting, Inc.

Identify

Management status for vulnerabilities (2/2)(e.g., vulnerabilities in Windows, Adobe Flash, etc.)

In terms of the presence or absence of a cyber security system, 36.3% of companies
with Cybersecurity team responded that "Management process is documented andexecuted" while only 14.3% of companies without a Cybersecurity team responded thatsame answer.
New vulnerabilities are being discovered every day, and there are cases of cyber-attack
exploitation. It is necessary to determine the priority of the response, including the
known vulnerabilities, and to respond effectively as an organization.
0%

10%With Cybersecurity

Withoutteam(n=273)

30%

40%

36.3%

team(n=226)

Cybersecurity

20%

14.3%

34.8%

50%

60%

70%

80%

41.6%

6.6%

15.4%

35.5%

90%

100%

15.5%

Management process is documented and executed

A part of management process is executedPlan to have management process

No plan to have management process
24© MS&AD InterRisk Research & Consulting, Inc.

ProtectProtect

Perimeter protection between the Internet and the company's
network (e.g., firewalls)
We checked the implementation status of perimeter protection between the Internet
and the company's network. Overall, 56.0% of companies Using external service or
device.
On the other hand, 29.8% of the companies said they have purchased but have notbeen able to using it, which means that the effectiveness of the security measuresremains an issue, as they cannot immediately respond to cyber attacks or fully
demonstrate their effectiveness.
In addition, in the “Cyber Security Rangers” that we were selected by IPA, there werecases where the staff didn‘t realized about installed UTMs. We believe that a one-stop
security service that provides monitoring and incident response services is necessary
for companies that cannot devote resources to their own operations.
Full

56.0%

Body(n=554)
0%

10%

20%

Using external service or device

30%

3.2%

29.8%
40%

50%

60%

70%

1.8%

4.2%
80%

90%

Having external service or device but not using

Plan to have

No device and no planNot connect to internet

Other

5.1%
100%

26
© MS&AD InterRisk Research & Consulting, Inc.

Protect

Establishing rules for user IDs, passwords, and permissions toview and update information (1/2)

Overall, about half (43.8%) of the companies responded that "rules regarding IDs,
passwords, and information access updates are documented, checked, and reviewed.
In addition, "Other" includes "No rules, but inspections are carried out," "Depends
on/complies with the parent company," and "Only PCs that handle personal information
are inspected. " and "Only PCs that handle personal information are inspected.
0%

Full Body(n=553)

10%

20%

30%

40%

43.8%

50%

15.6%

60%

70%

8.3%

80%

19.5%

90%

100%

10.3%
2.5%

Documented Rules and check, review process.
Documented Rules and but not check, not review process.
Plan to document rules
Has rules but not documented
No rules and no plan
Other

27
© MS&AD InterRisk Research & Consulting, Inc.

Protect

Formulate rules for user IDs, passwords, and permissions forreferencing and updating information (2/2)
Answer “”percentage of companies with Cybersecurity team was 56.0%, while thepercentage of companies without a cyber security structure was 31.8%.
0%

10%

20%

With Cybersecurityteam(n=274)

40%

50%

56.0%

team(n=225)

Without Cybersecurity

30%

60%

70%

16.4%

80%

7.6%

90%

14.2%

100%

4.9%
0.9%

31.8%

15.0%

9.9%

24.5%

15.3%
3.6%

Documented Rules and check, review process.

Documented Rules and but not check, not review process.

Plan to document rules

Has rules but not documented

No rules and no plan

Other

28
© MS&AD InterRisk Research & Consulting, Inc.

DetectProtect

Implementing EDR (Endpoint Detection and Response)
For the status of EDR (Endpoint Detection and Response) implementation, please refer
to Among companies that responded, "Implemented”, the retail industry (54.8%),
followed by the energy industry (54.5%) and other service businesses (51.4%) came out
on top.
The measures are being taken by companies that handle PII and IP information.
Fullbody(n=551)

44.3%

49.9%

5.8%

Manufacturing(n=157)

40.8%

53.5%

5.7%

42.3%

Information and…
Transportation(n=38)

53.8%
63.2%

36.8%
54.8%

Retail(n=31)
Wholesale(n=71)

41.9%

40.7%

51.9%

Restaurant /… 0.0%

Construction(n=46)
Mining(n=0)

36.4%
50.0%

real estate(n=12)

0.0%
9.1%

33.3%
41.3%

50.0%

5.6%
7.4%

100.0%
54.5%

Energy(n=11)

0.0%
3.2%

46.5%

47.9%

Finance / insurance(n=54)

3.8%

16.7%
8.7%

0.0%
51.4%

Service businesses(n=70)
Implemented

Not implemented

41.4%

7.1%

Other

30
© MS&AD InterRisk Research & Consulting, Inc.

Detect
Whether the security monitoring system's process for responding to andresponding to security alerts has been reviewed

We asked the respondents whether they responded to security alerts generated by
security monitoring systems (IPS, IDS, etc.) and whether they reviewed their response
processes. Overall, only 28.6% of the companies answered that they "audit, respond to,
and review security alerts," indicating that they are not fully prepared. The same trend
was observed for companies with and without an organizational structure, but there
was a nearly double difference in the percentage of companies that answered that they
"conduct audits, responses, and reviews" (38.2% for those with a structure and 18.6%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
for those without). 0%
Full body(n=465)
All (n=465)

With organization system (n=204)

No organization system (n=215)

28.6%.

38.2%.

18.6%.

8.8%.

Audit, response, and review are implemented.

11.6%.

18.5%.

41.3%.

12.3%.

12.7%.

36.8%.

22.8%.

49.8%.

Partially implemented.

Planning.

Other

31
© MS&AD InterRisk Research & Consulting, Inc.

Detect

Contracts for emergency support services, etc. in the event of asecurity incident (accident)
Compared to the previous year, there was no significant change in the overall response
rate trend, but the percentages of "I have a contract with an emergency response
service in case of an incident" and "Emergency response is conducted in-house"decreased.
With limited budgets and personnel, there is a possibility that the resources available
for contingency planning are decreasing. Under such circumstances, there is a great
deal of room for proactive use of services such as referrals to specialized service
providers attached to cyber insurance in the event of an accident.
0%2020(n=551)

10%

20%

30%

17.1%

40%

32.5%

50%

60%

6.5%

70%

80%

29.6%

90%

6.0%

100%

8.3%

49.6
2020(n=551)

18.9%

37.8%

4.2%

27.8%

7.0%

4.3%

56.7
I have a contract with an emergency response service in case of an incident
Emergency response is conducted in-house
Emergency response service contracts are planned in the event of an incident
No contract and plan
Planning of cntracting emergency support services to respond to incidents when they occur

32© MS&AD InterRisk Research & Consulting, Inc.

Respond and RecoverRespond and Recover

Status of training for security incidents (1/2)
As for whether they conduct drills in case of security incidents (accidents), the majority(55.9%) of the total companies answered that they do not conduct drills (nor do they
have plans to do so).
Other" included "Same as parent company," "Implemented by each department," and"Only education (classroom).
While a larger percentage of companies with experience of cyber security incidents
responded that they "conduct training" than those without experience, there are morethan 40% of companies that "do not conduct (nor plan to conduct) training" despite
their experience of incidents. It is necessary to enhance the training menu.
0%

Full body(n=556)
All (n=556)

10%18.2%.

With incident (n=87)
No incident (n=399)

20%
10.4%.

25.3%.
17.8%.

30%

40%

60%

70%

80%

55.9%.

10.4%.
13.8%.

10.0%.

50%

46.0%.

12.6%.

10.5%.

57.1%.

90%

100%
5.0%.
2.3%.
4.5%.

Training is conducted (non-IT departments also participate)
Training is being conducted (IT department only)
Training is planned.
No training is conducted (no plan)
Other

34
© MS&AD InterRisk Research & Consulting, Inc.

Respond and Recover

Status of training for security incidents (2/2)
Among companies with an organizational structure, many companies (28.8%)
answered that they "conduct training," and if "only the IT department conducts
training" is included, it accounts for about 40%. On the other hand, more than 70%(73.1%) of the companies without an organizational structure answered that they "donot conduct training.
For companies with an established organizational structure, security incident response
can be carried out while making appropriate decisions and responses as anorganization and utilizing past experience. For companies without an organizational
structure or with a small number of employees, it is necessary to outsource functions
that can handle possible cyber-attacks at the time when the scope of influence is small.
44.3 %

0%

10%

20%

With organization system (n=226)

28.8%.

No organization system (n=275)

8.4%. 6.5%.7.6%.

30%

40%

15.5%.

50%

60%

14.6%.

70%

80%
38.1%.

73.1%.

Training is conducted (non-IT departments also participate)
Training is being conducted (IT department only)
Training is planned.
No training is conducted (no plan)
Other

90%

100%
3.1%.
4.4%.

35

© MS&AD InterRisk Research & Consulting, Inc.

Respond and Recover

Whether the results of security incident training are reviewed(If you answered "1. Training is conducted (non-IT departments also participate)" or "Training is conducted (ITdepartments only)" in the previous question)

The companies that are currently reviewing the results of the training and the content
of the training accounted for 71.5% of the total, and when the companies that areplanning to review the content of the training (19.6%) are included, the companies thatare reviewing/plan to review the content account for about 90% of the total.
The "Others" category included responses such as "Will be handled by the parent
company" and "Do not feel the need to review.

71.5%

Full Body(n=158)

0%

10%

20%

30%

40%

19.6%

50%

60%

70%

80%

8.2%

90%

reviewing the results of the training and the content of the training accounted
planning to review the content of the training
Not reviewing
Other

0.6%

100%

36

© MS&AD InterRisk Research & Consulting, Inc.

Respond and RecoverTraining for incoming suspicious emails (targeted email training) (1/2)

Regarding whether companies are conducting training for incoming suspicious e-mails(targeted e-mail training), 42.5% of the total companies answered that they are
conducting training (total number of Practice with non-IT dept. and practice only IT dept).
If "planning to conduct training" is included, the overall majority of respondents areengaged in targeted e-mail training.
Compared to the aforementioned security incident training on a wide range of topics,
the percentage of companies conducting training is high, suggesting that targetedemail attacks are becoming a more familiar threat to companies.
0%10%

Full body(n=552)

Have had security

20%

incidents(n=395)

40%

3.6%

38.9%

50%

60%

10.7%

70%

80%

90%

42.0%

100%

4.7%

42.5％
4.6%

49.4%

incidents(n=87)
Don't have had security

30%

3.3%

36.7%

11.6%

Practice with non-IT dept.

Practice only IT Dept.

No practice and No Plan

Other

12.6%

31.0%

44.3%

2.3%

4.1%

Plan to have practice37© MS&AD InterRisk Research & Consulting, Inc.

Respond and RecoverTraining for incoming suspicious emails (targeted email training) (2/2)
A large number (59.1%) of companies with an organizational structure responded thatthey "conduct training (total number of practice with non-IT dept. and Practice ony IT
dept.). On the other hand, less than 30% (27.5%) of companies without anorganizational structure responded.
Establishing an organizational structure as well as security incident training is the firststep to strengthen the security system afterwards.
0%

10%

20%

With Cybersecurity team(n=225)

30%

40%

54.7%

50%

60%

4.4%

70%

13.3%

80%

90%

100%

25.3%
2.2%

59.1％
Without Cybersecurity team(n=273)

24.9%

2.6% 9.5%

57.9%
5.1%

27.5％
Practice with non-IT dept.

Practice only IT Dept.

No practice and No Plan

Other

Plan to have practice38© MS&AD InterRisk Research & Consulting, Inc.

Respond and Recover

Whether or not to review the results of training for suspicious
incoming e-mails (targeted e-mail training) (1/2)(If you answered "1. Training is conducted (non-IT departments also participate)" or "Training is conducted (ITdepartments only)" in the previous question)

The number of companies that are currently reviewing the results of the training andthe content of the training accounted for 75.7% of the total, and if the companies thatare planning to review the content of the training (9.8%) are included, more than 80%of the companies are reviewing/planning to review the content of the training.
In targeted email attacks, it is difficult to reduce the open rate to zero, so it is importantto provide education and training so that when an email is opened, it can be quickly
and appropriately reported and dealt with.

Full Body(n=235)

75.7%

0%

10%

20%

30%

40%

50%

60%

70%

9.8%

9.8%

80%

90%

4.7%

100%

85.5％

reviewing the results of the training and the content of the training accounted
planning to review the content of the training
Not reviewing
Other

39
© MS&AD InterRisk Research & Consulting, Inc.

Respond and Recover

Whether or not to review the results of training on suspicious
incoming e-mails (targeted e-mail training) (2/2)(If you answered "1. Training is conducted (non-IT departments also participate)" or "Training is conducted (ITdepartments only)" in the previous question)

The targeted e-mail training service we provide comes in two patterns: a full package
plan that includes three learning opportunities: "pre-learning," "training e-mail," and"post-learning," and a plan that includes only "training e-mail. The full package planaccounts for more than 70% of the services offered, indicating that there is a need fortraining that includes "actions to be taken when a targeted e-mail is opened".

Pre-Learning

Training e-mailPost-Learning

Click!

Self learning tools

Alert +
Experiment
Incident

Disclose +Self learning tools

40© MS&AD InterRisk Research & Consulting, Inc.

Occurrence of cyber security incidentsOccurrence of cyber security incidents

Past cyber security incidents (1/2)
When asked if there had been any cyber security related incidents in the past, 15.6% of
the companies answered "yes".
Looking at the results by organizational structure, a high percentage (12.3%) ofcompanies with no structure responded that they "do not know or do not understand,"suggesting that even if there were accidents, they may not have been detected in thefirst place.
0%

Full body(n=557)

10%

20%

30%

15.6%

40%

50%

60%

71.6%

70%

80%

90%

100%

8.8%
3.9%

With Cybersecurity team(n=226)

18.1%

73.0%

4.0%
4.9%

Without Cybersecurity team(n=276)

13.8%

70.7%

12.3%
3.3%

Yes

No

Do not know

DO not want to answer

42© MS&AD InterRisk Research & Consulting, Inc.

Occurrence of cyber security incidents

Cyber security incidents in the past
When compared by the number of employees, the percentage of companies that
responded that an accident had occurred was higher for companies with more
employees.
In addition to indiscriminate attacks, large companies are more likely to meet cyberattacks as the ultimate target of targeted attacks and supply chain attacks, I would guess.
0%
5 or less employees (n=24)

10%

20%

30%

0.0%

40%

50%

60%

70%

87.5%

6 to 20 employees(n=63) 4.8%

80%

90%

100%

8.3%

76.2%

15.9%

3.2%

21 to 50 employees(n=79)

10.1%

77.2%

10.1%

51 to 100 employees(n=76)

11.8%

75.0%

11.8%

101 to 300 employees(n=152)
301to 500 employees(n=52)
501 to 1,000 employees(n=45)

2.5%
1.3%

14.5%

73.0%

19.2%

No

5.3%
3.8%
1.9%

62.2%

6.7%
2.2%

33.3%

Yes

7.2%

75.0%

28.9%

1,001 or more employees (n=66)

4.2%

51.5%

Do not know

6.1%

Do not want to answer

9.1%

43

© MS&AD InterRisk Research & Consulting, Inc.

Occurrence of cyber security incidents

Details of the most damaging cyber security incidents(If you answered "have had a cyber security incident")

When the contents of the most damaging cyber security incidents that occurred in thepast were checked, malware (46.0%), unauthorized access (23.0%), and targeted
attacks (8.0%) were ranked first, second, and third, respectively.
The "Other" category includes "Insider", "Rewriting of HP/web pages", "Hijacking of email accounts", and "DDoS attacks" and others.

Don't want to answer
9.2%
Other
13.8%

Targeted attack
8.0%

Malware46.0%
Reason of
the biggest
incident(n=87)

Unauthorized access
23.0%
44© MS&AD InterRisk Research & Consulting, Inc.

Occurrence of cyber security incidents

Amount of damage from the most damaging cyber security
incidents (If you answered "have had a cyber security incident")
Among the cyber security incidents that occurred in the past, when we checked theamount of damage of the most damaging incident, the first place was less than 1
million yen (46.4%), the second place was between 1 million yen and 10 million yen(8.3%), and the third place: 10 million yen or more (3.6%).
Don't want to answer
22.6%

Less than 1 million yen

Don't know / don't know
19.0%

10 million yen or more
3.6%

Amount ofdamage fromthe accident
that caused themost damage(n=84)

46.4%

1 million yen to less than 10 million yen
8.3%

45

© MS&AD InterRisk Research & Consulting, Inc.

Occurrence of cyber security incidents

How did you become aware of the accident?

(In the case of respondents who answered "the most damaging cyber security incident")

When asked how they recognized cyber security related incidents, the largest numberof companies (42.9%) answered "report from employees themselves". This wasfollowed by "detection by the system (including internal monitoring system (28.6%)" and"notification or inquiry from outside the company (10.4%)".
The "Others" category included responses such as "Deterioration in risk score (external
evaluation)" and "Deterioration in response time for sending/receiving e-mails.
DO not want to
Do not know, 2.6%

answer, 2.6%

Detection by
outsourced
monitoring system,other, 9.1%

How did you
become awareof the accident

External Inquiries,

Internal Issues,
42.9%(n=77)

10.4%

System detection, 28.6%

46© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

Cyber insurance

Cyber Insurance / data breach Insurance (1/2)
More than 80% of the companies “No have” cyber insurance or data breach insurance
policy, respectively. 16.8% of the companies have cyber insurance policy and 18.8%
have data breach insurance policy, which is low for the overall participation status.
0%

10%

20%

Cyber Insurance (n=546)

16.8%

data breach Insurance(n=549)

18.8%

30%

40%

13.7%

50%

60%

70%

90%

100%

69.4%

12.9%

Have Policy

80%

68.3%

Plan to have

No have and no plan48
© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

Cyber Insurance/Data breach Insurance Participation Status (2/2)
In terms of organizational structure, there is a difference in insurance coverage between
companies with and without a structure. For example, the rate of cyber insurance
coverage was 21.7% for those with cybersecurity team, double the rate for those withoutteam(11.2%).
The rate of data breach insurance was 24.8% for those with cybersecurity team, while itwas 12.2% for those without team, also doubling.
0%With Cybersecurity team(Cyber Insurance)(n=226)

Without Cybersecurity team(Cyber Insurance)(n=269)

With Cybersecurity team(Data breach Insurance)(n=226)

Without Cybersecurity team(Data breach Insurance)(n=271)

Have Policy

10%

20%

21.7%

30%

12.2%

11.1%

Plan to have

50%

60%

16.8%

11.2% 11.5%
24.8%

40%

70%

80%

90%

100%

61.5%

77.3%

15.9%

59.3%

76.8%

No have and no plan49
© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

Deciding factor for purchasing insurance* Multiple choices(If you answered "Yes" to the previous question)

For both cyber insurance and data breach insurance, the most common reason forpurchasing insurance was that the coverage was suitable for the company (80.2% forcyber insurance and 77.0% for data breach insurance).
Only about 10% of the companies in both cyber insurance and data breach insurance
cited "requests from business partners" as the reason.
In the "Other" category, there were responses such as "Lump-sum contract by parent
company/group company" and "Request from parent company/head office.

50© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

Reasons for not having insurance* multiple choice (1/2)(If you answered "Considering" or "Have not joined" in the previous question)

As reasons for not purchasing insurance, a certain number of companies answeredthat they did not know the insurance existed (cyber insurance: 25.8%, data breachinsurance: 27.2%) or that they don’t need the insurance (cyber insurance: 28.0%, data
breach insurance: 25.5%).

51© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

Reasons for not having insurance* multiple choice (2/2)(If you answered "Considering" or "Have not joined" in the previous question)

The reasons for not purchasing cyber insurance were compared with the previous year's
survey. The most common answer last year was "I didn't know there was cyber
insurance (30.7%)".
However, the most common response this year was "I don’t need the insurance (28.0%).
While the awareness of cyber insurance is increasing, the number of companies that do
not feel the need to purchase it is also increasing.

52© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

What you want to be covered by cyber insurance* Multiple choices
The most common loss expected to be compensated by insurance was "compensation
for damages in the event of an data breach" (68.0%), followed by "response andrestoration costs" (59.8%).
Among the "Others," there were responses such as "expenses for lawyers and advisors
to deal with the media in the event of an incident.

0.0%

Full Body(n=547)

10.0%

20.0%

30.0%

40.0%

70.0%

80.0%

68.0%

Liability
Business interruption

25.4%

Cost for replacement

Nothing to require

60.0%

59.8%

Cost for recovery

Other

50.0%

36.2%
1.8%
20.7%

53
© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

Expect as a supplementary service for cyber insurance

As for the expected services, the highest expectation was for the consultation call center(55.9%), the rush service in case of accidents (41.2%), and vulnerability assessment(31.7%), in that order.
0%

Necessary.
It is rather necessary.

20%

Not necessary.

Vulnerability assessment (n=537)

60%

55.9%.

Call center for consultation (n=537)

80%

12.9%. 10.8%.

35.1%.

31.7%.

100%

8.9%. 9.1%.

26.1%.

41.2%.

Rush service in case of accidents (n=536)

It is rather not necessary.

40%

14.0%. 10.1%.

44.3%.

16.2%.

45.1%.

Security assessment (scoring) service (n=537)

25.7%.

Support for documentation of countermeasure policies, standards, and procedures (n=537)

24.2%.

Security equipment with cyber insurance (n=535)

22.6%.

A package service that covers prevention, detection, and initial response to accidents (n=534)

22.5%.

42.1%.

22.7%.

12.7%.

Support and training for building an initial response system in case of an accident (n=535)

22.2%.

43.4%.

23.2%.

11.2%.

Service for calculating the expected (maximum) amount of damage (n=537)

22.0%.

44.9%.

22.3%.

12.8%.

Support for complying with the revised Personal Information Protection Law (n=536)

20.3%.

Referral service for professional (forensic) service providers in case of accidents (n=534)

19.3%.

40.1%.

26.2%.

14.4%.

Provision of information on the dark web and other intelligence (n=534)

17.2%.

41.4%.

27.9%.

13.5%.

Support for building organizational structure (n=537)

16.8%.

Asset management support (n=537)

13.2%.

Introduction of security vendors (n=535)

11.8%.

21.2%.

40.4%.
37.9%.

22.8%.

24.3%.

42.2%.

36.7%.

30.4%.

35.0%.

14.2%.
16.6%.

13.2%.

16.2%.

33.7%.

34.6%.

13.0%.

18.4%.
33.3%.

54© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

Expect as a supplementary service for cyber insurance

When we ranked the expected services for both overall and companies that do nothave cyber insurance, we found a similar trend, but for companies that do not haveinsurance, "a package service that includes protection, detection, and initial responsein the event of an accident (23.4%)" was the top choice.
The uninsured were found to have a need for added value that would lead to protection,
detection, and initial response, not just after-the-fact measures.

Rank

whole
Expectations for ancillary services

Rank

Companies that do not have cyber insurance
Expectations for ancillary services

1Consultation call center (55.9%)

1Consultation call center (57.5%)

2

Rush service in case of accidents (41.2%)

2

Rush service in case of accident (42.6%)

3

Vulnerability assessment (31.7%)

3

Vulnerability assessment (33.2%)

4

Security diagnosis (scoring) services(25.7%)

4

Security diagnosis (scoring) services (25.1%)

5Support for preparing documents on
countermeasure policies, standards,
procedures, etc. (24.2%)

5

A package service that combines prevention,
detection, and initial response to an accident(23.4%)

6

Security equipment with cyber insurance(22.6%)

6

Security equipment with cyber insurance (23.2%)

7

A package service that combines prevention,
detection, and initial response to an accident(22.5%)

7

Support for preparing documents on countermeasurepolicies, standards, procedures, etc. (22.9%)

2020

55

© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

What to expect as a supplementary service when
you purchase cyber insurance (2/2)
whole
Rank

Expectations for ancillary services

Companies that do not have cyber insurance
Rank

Expectations for ancillary services

2020

Support and training for building an initial
Support and training for building an initial response
8 response system in the event of an accident
8system in the event of an accident (20.8%)(22.2%)
Calculation service of expected (maximum)
Calculation service of expected (maximum) loss
9
9loss (22.0%)(20.2%)
Support for compliance with the revised
Support for compliance with the revised Personal
10
10Personal Information Protection Law (20.3%)
Information Protection Law (19.9%)
Referral service for professional (forensic)
Referral service for professional (forensic) service
11 service providers in case of accidents
11
providers in case of accidents (17.0%)(19.3%)
12

Providing intelligence information on thedark web, etc. (17.2%)

12Providing intelligence information on the dark web,etc. (16.8%)

13

Support for building organizational structure(16.8%)

13 Support for building organizational structure (16.3%)

14 Asset management support (13.2%)

14 Asset management support (12.3%)

15 Referrals from security vendors (11.8%)

15 Referrals from security vendors (9.6%)

56© MS&AD InterRisk Research & Consulting, Inc.

Cyber Security and MS&AD Platform
The MS&AD Group has compiled solutions corresponding to the Framework for Cyber Cyber Security
as the "MS&AD Cyber Security Platform. Please use this platform when you take cyber security
measures, such as using a specialized service provider if you are unable to take measures by
yourself, or purchasing insurance as a countermeasure for remaining risks.

57© MS&AD InterRisk Research & Consulting, Inc.

MS&AD InterRisk Research Institute, Inc.
Cyber Risk Sec., New Business Development Dept.

Wateras Annex, 2-105 Awaji-cho, Kanda, Chiyoda-ku, Tokyo 101-0063, Japan
Tel：+813-5296-8961 / Fax：+813-5296-8940
https://www.irric.co.jp/© MS&AD InterRisk Research & Consulting, Inc.