Research of SMB’s
Cybersecurity measures inJapan 2018

Introduction

Introductions<Introductions>
Accidents and damage caused by Cybersecurity incidents are on an increasing
trend year by year, and it is very common to see these reports on media.
Information security is a management subject and, taking information security
measures is an important issue that can no longer be avoided as enterprise and
SMB’s management.
Therefore, this time, we surveyed the actual condition of enterprises and SMBs
aimed at contributing to the reduction of information security risk in the future.
We hope this survey will be helpful to companies for further efforts.

© MS&AD InterRisk Research & Consulting, Inc.

Introductions<Insights>① Companies that have an organized Cybersecurity Team (structure) have advantageous
results in Cybersecurity measures as well as rates of having cyber insurance.
② In addition to the organizational structure improvement, the policy ⇒ standard ⇒procedure, that the correspondence with documents and rules also developed into morepractical one is also a point as a matter of actual security measures.
③ One of the reasons for measures to be taken by developing the organizational structureis that making 'what should be implemented' clearer by external information which isprovided from organizations outside the company (ex. Nippon CSIRT Association, JNSA,
IPA, etc.).
④ About cyber insurance, companies are not understanding its existence and contents(compensation scope, targeted accident, etc.).

Organize
Cybersecurity team
Reviewing and
PDCA cycle
Documents & Rules
Get external
information

Remediation

Clarify theremediation points© MS&AD InterRisk Research & Consulting, Inc.

Overview of the ResearchOverview of the Research

Outline of research
Survey method

Mailing questionnaire (combined with Web
response)

Targeted companies

10,000 companies in Japan
Extracted from Toyo Keizai Inc.'s "40,000
company data in Japan ((1) Basic data)"
Companies that randomly extracted inindustry by industry

Number of valid
responses

689 (total collected number: 701)
Recovery rate 6.9%

Survey period

September 26 - October 12, 20185
© MS&AD InterRisk Research & Consulting, Inc.

Overview of the Research

Industry and size of the companies
Other, 3.5%
Construction, Mining, 0.3%

Manufacture,

7.7%

29.6%

Real estate,

Services,

3.6%

16.0%

（n=688）>1,001
employees,

Energy, 1.7%

9.4%

Education,

Under 5
employees,
5.7%

6～20
employees,
12.1%

0.4%
IT, Telecom,

Health, 0.1%

8.0%

Accommodati
on, 1.6%

Financial, Wholesale,
6.7%

9.1%

21～50

Transport,
Retail, 5.2%

（n=689）6.4%

employees,

101～

13.8%

1,000employ
ees, 42.7%

51～100employees,
16.3%

6© MS&AD InterRisk Research & Consulting, Inc.

Utilization of IT

Utilization of IT

Utilization of servers (include cloud)
It is more than 90% who answered “Yes”. And as the number of
employees increases, the usage ratio of servers (include cloud) increases.
0%(n=689)

20%

40%

60%

80%

100%

92.7%
Use

7.3%

Not use0%≧5 employees(n=39)
6-20 employees(n=83)

20%

40%

60%

64.1%

80%

100%

35.9%

85.5%

14.5%

21-50 employees(n=95)

93.7%

6.3%

51-100 employees(n=112)

93.8%

6.3%

101-1,000 employees(n=294)

96.3%

3.7%

100.0%

0.0%≦1,001 employees(n=65)
Use

Not use8© MS&AD InterRisk Research & Consulting, Inc.

Utilization of IT

The services for customer on Internet
It is higher than 20% who answered “Yes”. But those companies which are
more than 1,001 employees were answered more than 40% as “Yes”.
0%(n=689)

20%

40%

60%

21.2%

80%

100%

78.8%
ProvideNot provide
0%≧5 employees(n=39)

20%

40%

7.7%

60%

13.3%

86.7%

21-50 employees(n=95)

12.6%

87.4%

51-100 employees(n=112)

15.2%

84.8%

≦1,001 employees(n=65)

100%

92.3%

6-20 employees(n=83)

101-1,000 employees(n=294)

80%

24.5%

75.5%

47.7%

52.3%
ProvideNot provide

9© MS&AD InterRisk Research & Consulting, Inc.

Utilization of IT

Data exchange with other entities
It is almost 60% who answered “Yes” for data exchange with other entities.
And 83 % of the more than 1,001 employees companies answered “Yes”.
0%(n=685)

20%

40%

60%

80%

59.3%
Exchange data

100%

40.7%
Not exchange data
0%

≧5 employees(n=39)
6-20 employees(n=81)

20%

40%

60%

43.6%

80%
56.4%

49.4%

50.6%

21-50 employees(n=95)

53.7%

46.3%

51-100 employees(n=111)

55.0%

45.0%

101-1,000 employees(n=293)≦1,001 employees(n=65)

100%

62.1%

37.9%

83.1%
Exchange data

16.9%

Not exchange data

10
© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Internal Organization Management

Cybersecurity Team *Multiple selection
The majority of responding companies have not established acybersecurity team. But ”CISO” is most popular in the companies that
replied "Yes".
(n=672)
0%

20%

40%

60%

36.3%

80%

100%

55.2%

Have Security TeamNo security Team

8.5%

Other
(n=672)

60%

55.2%

40%

25.6%
16.5%

20%

0%

12.9%

CISO

CSIRT

SOC

9.8%

Other

No

12

© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Cybersecurity team established *Multiple selection
Looking further by the number of employees, 40% of companies withmore than 1,001 employees are establishing "CSIRT", and theorganization size is considered to be related to the establishment of CSIRT.

60%

55.2%

40.0%

40%

38.5%

33.8%

27.7%

25.6%
16.5%

20%

0%

CISO

12.9%

CSIRT
(n=672)

SOC

9.8%

6.2%

その他

ない

≦1001 e,ployees'(n=65)

13© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Documents for cybersecurity *Multiple selection“Policy” (65.0%) are most frequently maintained as cybersecurity
documents and regulations.
In the “Other”, there were answers such as ‘It complies with the groupcompany/parent company’, ‘There is a handbook’ and etc..
全体(n=683)
80%

65.0%
60%

46.7%
40%

29.1%

36.6%
17.7%

20%

4.7%
0%

PolicyStandard

Procedure

Guideline

Other

No documents

14© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Documents for cybersecurity *Multiple selection
Assuming that the status of development of security documents is to be
improved with policy ⇒ standard ⇒ procedure ⇒ guideline and classified
into 5 categories according to level as below, nearly half of companies
organize documents in order.
0%

18.0%

20%

40%

60%

7.3% 8.2%

14.8%

80%

100%

51.7%

48.3%
Level1(n=123)

Level2(n=50)

Level３(n=56)

Level4(n=101)

Other(n=353)

PolicyStandard

Procedure

Guideline

Level 1

○

ー

ー

ー

Level 2

○

○

ー

ー

Level 3

○

○

○

ー

Level 4

○

○

○

○

Other

ー
15
© MS&AD InterRisk Research & Consulting, Inc.

Internal Organization Management

Audit of the documents *Multiple selection(When they answered that they have documents in the previous question)

41.8% of the companies chose “audit by third parties outside thecompany”, and it becomes over 60% of the companies with having morethan 1,001 employees and 61.4% of the companies that have reachedlevel 4 on the previous page.
0%

20%

40%

External 3rd party Audit

41.8%
40.7%

Internal same dept. Audit

34.3%

Internal different dept. Audit

Planning to have Audit

6.1%

No Audit (No Planning)

Other

60%

13.6%

3.4%

16
© MS&AD InterRisk Research & Consulting, Inc.

3rd Party (Subcontractor) Management

3rd Party (Subcontractor) Management

Implementation status of audit and report on
information management for outsourcer

Overall, there was the largest number of enterprises with "not completed"(43.2%), but companies with more than 1,001 employees had a relatively
high response (47.7%) that "audits and reports made by outsourcer
0%
10%
20%
30%
40%
50%
60%
themselves".
All(n=671)

4.8%
8.5%
7.2%

21-50 employees(n=94)

51-100 employees(n=108)101-1,000 employees(n=287)≦1,001 employees(n=65)

52.8%

8.3%
11.1%
8.3%
11.1%
11.1%

≧5 employees(n=36)

6-20 employees(n=80)

20.1%

43.2%

29.8%

3.8%
8.8%
5.0%

17.5%

32.5%

No audit and report
52.1%

20.2%
10.6%
16.0%
4.3%
9.6%
2.8%

13.9%
8.3%

3.8%
7.3%
6.6%
1.5%

9.2%
4.6%

Audit and report by outsource
Audit and report by 3rd party

25.0%
22.2%

19.9%

42.5%

39.8%

32.4%
32.3%
32.3%

Audit and report by answerer
Plan to do

43.2%

Other

47.7%
18
© MS&AD InterRisk Research & Consulting, Inc.

Identify

Identify

Handling status of information assets
With regard to information classifications such as information to be kept
confidential, information limited within the company, information which
can be provided to the confidentiality agreement, publicly available
information and etc. there were 44.4% responded that "There are rules".
0%(n=678)

20%

40%

44.4%

60%

9.0%

9.6%

80%

6.9%

17.3%

100%

12.8%

Classify information assets by documented rules
Not classify information assets by documented rules
There is no rule for asset classification, but plan to haveClassify information assets, but no documented rules and no plan to haveClassify information assets, but no rules
No rules and No classification

20© MS&AD InterRisk Research & Consulting, Inc.

Identify

Handling status of information assets
86.1% of companies answered it is categorized in companies withcybersecurity team, about 70% of them answered: ”the rules are
documented and classified information assets in accordance with therules."
0%

20%

With Cybersecurity

Team(n=364)

60%

61.5%

Team(n=244)

Without Cybersecurity

40%

30.5%

8.2% 11.3% 7.7%

80%

100%

6.1%
9.8% 7.8%
10.7% 4.1%

22.3%

20.1%

Classify information assets by documented rules
Not classify information assets by documented rules
There is no rule for asset classification, but plan to haveClassify information assets, but no documented rules and no plan to haveClassify information assets, but no rules
No rules and No classification

21© MS&AD InterRisk Research & Consulting, Inc.

Identify

Issues and vulnerabilities of information assets
We confirmed the management status of the "problem and vulnerability of
information assets" which we possess. 73.8% answered that they are
managing it. Although 33.7% of respondents who answered that they are
managing both issues and vulnerabilities.
0%(n=676)

20%

33.7%

40%

60%

80%

8.0%4.4%

27.7%

10.5%

73.8%

100%

15.7%

Manage both issues and vulnerabilities

Manage only issues

Manage only vulnerabilities

Manage part of issues &/or vulnerabilities

Plan to mange

No manage and no plan22
© MS&AD InterRisk Research & Consulting, Inc.

Identify

Issues and vulnerabilities of information assets
Separate the presence or absence of a company's cybersecurity
team, ”Managing both issues and vulnerabilities” account for 48.5% incompanies with a cybersecurity team, while it is only 22.2% in companies
that do not have a team. There is a big difference depending on thepresence or absence of a cybersecurity team.
0%

20%With Cybersecurity

48.5%

Team(n=241)
Without Cybersecurity
Team(n=365)

40%

22.2%

7.4%

4.1%

60%

80%

9.1% 4.6%

29.0%

25.7%

14.5%

100%

6.6% 5.4%

22.7%

Manage both issues and vulnerabilities

Manage only issues

Manage only vulnerabilities

Manage part of issues &/or vulnerabilities

Plan to mange

No manage and no plan23
© MS&AD InterRisk Research & Consulting, Inc.

Identify
Issues and vulnerabilities in hardware asset management
We confirmed issues and vulnerabilities in hardware asset management.
Overall, 79.0% of companies replied that they are managing (except 'plan
to manage' · 'not manage (not planned)’). And about half of themanswered "We manage both issues and vulnerabilities" (36.6% of thetotal).
0%(n=670)

20%

36.6%

40%

60%

10.0%
5.2%

79.0%

80%

27.2%

7.5%

100%

13.6%

Manage both issues and vulnerabilities

Manage only issues

Manage only vulnerabilities

Manage part of issues &/or vulnerabilities

Plan to mange

No manage and no plan24
© MS&AD InterRisk Research & Consulting, Inc.

Identify
Issues and vulnerabilities in hardware asset management
By separating the presence or absence of company's cybersecurity team,companies that responded "There is no plan (not planned)" are 6.6% forcompanies with cybersecurity team, while 18.5% for companies without
cybersecurity team which shows there are large differences depending onwhether or not the companies have a cybersecurity team.
0%

20%With Cybersecurity

47.7%

Team(n=241)
Without Cybersecurity
Team(n=363)

40%

25.9%

10.2%

5.5%

60%

80%

100%

10.4% 5.8%

24.5%

5.0% 6.6%

30.0%

9.9%

18.5%

Manage both issues and vulnerabilities

Manage only issues

Manage only vulnerabilities

Manage part of issues &/or vulnerabilities

Plan to mange

No manage and no plan25
© MS&AD InterRisk Research & Consulting, Inc.

ProtectProtectBoundary defense between the Internet and its own network(ex. firewall)
We confirmed the implementation status of the boundary defense between
the Internet and its own network. The answers that are implementing(”Using external service", ”Implement own device (such as a firewall) ")are about 90%.
0%(n=678)

20%

40%

60%

46.3%

80%

41.9%

100%

3.7% 4.9%
2.2% 1.0%

Using external service

Implement own device

Plan to have

No device and no planNot connect to internet

Other

27
© MS&AD InterRisk Research & Consulting, Inc.

Protect

Rules and formulation of user ID, password andauthority for reference and update of information
There are a majority (50.4%) of companies that responded the rules are
documented and inspections and reviews are also being carried out.

0%(n=678)

20%

40%

50.4%

60%

14.2%

80%

4.3%

18.7%

100%

11.2%

1.2%

Documented Rules and check, review process.
Documented Rules and but not check, not review process.
Plan to document rules
Has rules but not documented
No rules and no plan
Other

28
© MS&AD InterRisk Research & Consulting, Inc.

Protect

Rules and formulation of user ID, password andauthority for reference and update of information
69.5% for companies with cybersecurity team and 34.9% for companies
without a cybersecurity team, which is more than 30 points away.
In addition, "Other" had a statement that "conforms to therule/management of the parent company".
0%20%With Cybersecurity

Team(n=367)

60%

69.5%

Team(n=243)
Without Cybersecurity

40%

34.9%

14.4% 5.4%

80%

100%

7.4%
15.6%
0.8%
3.7%
2.9%
26.4%

18.3%

0.5%

Documented Rules and check, review process.
Documented Rules and but not check, not review process.
Plan to document rules
Has rules but not documented
No rules and no plan
Other

29
© MS&AD InterRisk Research & Consulting, Inc.

ProtectStatus of antivirus/antimalware software
There are nearly 90% of companies that replied: “installed on all PCs &servers". In addition, "Other", there was a reply that it is being
implemented by the parent company.

0%

20%

40%

60%

80%

88.5%

(n=678)

100%

4.1%
4.3%

1.3%

0.4%1.3%
Install all PCs and Servers
Install some PCs and Servers, plan to install for all
Install some PCs and Servers, but no plan to install for all
Not installed but plan to install
Not installed and no plan
Other

30
© MS&AD InterRisk Research & Consulting, Inc.

ProtectStatus of updating/monitoring of software(Only install in the previous question)

More than 90% of respondents are ”Update, monitoring and having
a process when finding vírus, malware & etc.".

0%(n=652)

20%

40%

60%

80%

91.3%

100%

3.7% 2.3%
2.8%

Updating, Monitoring and having process when find virus, malware & etc.
Having some of process
Plan to have process
Not have and no plan to have31
© MS&AD InterRisk Research & Consulting, Inc.

ProtectStatus of vulnerability management (ex. Windows update)
Considering that ”Implemented & documented management methodology"
and "conducting partly" together, more than 60% of companies aremanaging their vulnerabilities. However, less than 30% of the
respondents are documented their methodologies.
0%(n=673)

20%

40%

29.4%

60%

37.6%

80%

8.3%

100%

24.7%

Management process is documented and executed

A part of management process is executedPlan to have management process

No plan to have management process

32© MS&AD InterRisk Research & Consulting, Inc.

ProtectStatus of vulnerability management (ex. Windows update)Companies with cybersecurity team achieved 47.1% for ”Implemented &documented management methodology” and more than 80% aremanaging vulnerability. On the other hand, 35.9% of companies without acybersecurity team are “No plan to have management process”.
0%

20%

With Cybersecurity

47.1%

Team(n=242)

Without Cybersecurity
Team(n=365)

40%

14.5%

Management process is documented and executedPlan to have management process

60%

34.3%

40.0%

9.6%

80%

100%

7.4% 11.2%

35.9%

A part of management process is executed
No plan to have management process

33© MS&AD InterRisk Research & Consulting, Inc.

Detect

Detect

Security monitoring systems implementation statusex) IDS and IPS
The largest majority is ”Not implemented and no plan" (33.8%),
then ”Implemented by outsourcing" (33.4%) comes second.
0%

20%

40%

33.4%

(n=671)

60%

18.6%

80%

100%

33.8%

14.2%

Implemented by outsource

Implemented and administrate by internal team

Plan to implement

Not implmented and no plan to implement

It is higher for “Implemented by outsourcing“ (44.0%) for companies withcybersecurity team. But on the other hands, “Not implemented and noplan” (47.3%) is a majority of companies without cybersecurity team.
0%With Cybersecurity Team(n=241)

Without Cybersecurity Team(n=366)

20%

40%

44.0%
24.3%

13.1% 15.3%

60%

80%

26.1%

12.9%

100%
17.0%

47.3%

Implemented by outsource

Implemented and administrate by internal team

Plan to implement

Not implmented and no plan to implement35© MS&AD InterRisk Research & Consulting, Inc.

Detect
Audit of security monitoring systems and define processes forincidents.
“Both monitoring and reviewing” is a majority (57.2%) of the respondents.
0%(n=346)

20%

40%

60%

57.2%

6.9%

80%

100%

12.4%

23.4%

Both Monitoring and Reviewing

A part of monitoring and reviewing are done

Plan to monitoring and/or reviewing

Other

Compare by with or without a cybersecurity team, there is a huge
difference (28.3points) between. (With:69.5%, Without:41.2%)
0%With Cybersecurity Team(n=167)

Without Cybersecurity Team(n=136)

20%

40%

69.5%
41.2%

9.6%

60%

80%

100%

6.0% 18.0% 6.6%

35.3%

14.0%

Both Monitoring and Reviewing

A part of monitoring and reviewing are done

Plan to monitoring and/or reviewing

Other

36
© MS&AD InterRisk Research & Consulting, Inc.

Detect

Policy for system logs
The largest majority is “Has Policy and Audit & review are done“ (36.2%).
But on the other hands, “No Policy and no plan” (32.8%) is in the second
majority.
It is very similar to the analysis for ”Security monitoring systems” (P.35)
0%(n=674)

20%

36.2%

40%

17.4%

60%

13.6%

80%

100%

32.8%

Has Policy and Audit & review are done

Has policy but Audit and review are not done

Plan to make a policy

No ploicy and no plan to have37
© MS&AD InterRisk Research & Consulting, Inc.

Respond & RecoverRespond & RecoverTraining for the security incidents occur
More than half (54.1%) are responded “No practice and no plan”.
In “Other”, we received the answer like; “Order from a parent company”,“Training for targeted attack e-mails” and so on.

0%(n=675)

20%

13.3%

6.8% 10.8%

40%

60%

80%

54.1%

12.9%

Practice with non-IT dept.

Practice only IT Dept.

Practice has been carried out in somePlan to have practiceNo practice and No Plan

Other

100%

2.1%

39
© MS&AD InterRisk Research & Consulting, Inc.

Respond & RecoverTraining for the security incidents occur
Compare by with or without of cybersecurity team, a total of “Practice” of“With” is almost half (48.0%). But on the other hands, a total of “Practice”
of “Without” is only 18.6%. There is a huge difference (29.8points).

0%With Cybersecurity Team(n=242)

20%

23.6%

Without Cybersecurity Team(n=365) 5.5%
8.2%
4.9%

40%

8.7%

15.7%

12.1%

60%
14.9%

80%

36.0%

68.5%

100%

1.2%

0.8%

Practice with non-IT dept.

Practice only IT Dept.

Practice has been carried out in somePlan to have practiceNo practice and No Plan

Other

40
© MS&AD InterRisk Research & Consulting, Inc.

Respond & Recover

Review of “Training for the security incidents occur”
70.7% of respondents are ”Look back practice and reviewing for nexttime”. And including who has the plan to review, it becomes more than90%. It means most of the companies who have practice/training arereviewing/plan to review.
0%(n=133)

20%

40%

60%

70.7%

Look back practice and reviewing for next time

Plan to reviewing for next time,

80%

100%

20.3%

7.5% 1.5%

No reviewing and no plan

Other

41
© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

Cyber insurance

Status of cyber insurance & data breach insurance“Not have and no plan” achieved more than 70% for both insurances. It isonly 12.7% for cyber insurance and 18.2% for data breach insurance whohave a policy.

0%

Cyber Insurance(n=667)

Data breach insurance(n=661)

20%

12.7%

40%

100%

71.6%

10.3%

Have Policy

80%

76.5%

10.8%

18.2%

60%

Plan to have

No have and no plan43
© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

Status of cyber insurance & data breach insurance
Compare by with or without of cybersecurity team, it is 16.5% “withcybersecurity team” who has cyber insurance policy which is 8.0%
“without”. (More than two times). For data breach insurance, the situation
seems the same as “with” is 25.8% and “without” is 11.6%.
0%With Cybersecurity Team/Cyber
Insurance(n=242)
With Cybersecurity Team/Data breachinsurance(n=240)
Without Cybersecurity Team/Cyber
Insurance(n=363)
Without Cybersecurity Team/Data breachinsurance(n=362)

20%

16.5%

25.8%

8.0%

40%

80%

100%

68.2%

15.3%

61.3%

12.9%

83.7%

8.3%

11.6% 8.6%

Have Policy

60%

79.8%

Plan to have

No have and no plan44
© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

The reason who don’t have policy *multiple answer
The Majority is “Didn‘t know about the insurance” (Cyber insurance:36.2%
and Data breach insurance:37.8%) and not “Expensive premium”.
0%

20%

40%
36.2%
22.9%
25.6%

Cyber Insurance(n=503)

Didn't know

11.9%
10.9%

Never offered

5.8%
No needs

37.8%
22.1%
24.7%

Data breach Insurance(n=466)

Don't know detail about insurance
Expensive Premium

12.7%
11.4%

Other

5.4%

45
© MS&AD InterRisk Research & Consulting, Inc.

Cyber insurance

Required coverage *multiple answer
The majority of the answer is “Liability (63.3%)” and for the second, “Costfor recovery”(58.6%).

0%

20%

40%

60%

80%

Liability

63.3%

Cost for recovery

58.6%

Cost for replacement

35.8%

Business interruption
Other
Nothing to require

23.5%
1.9%
23.8%

46
© MS&AD InterRisk Research & Consulting, Inc.

Questionnaire

Cost, Liability,
Introduce Cyber
Vender etc.

ScoringGlobal Company

Forensics

Intelligence Report

CSIRT Class

Training for Media

Endpoint Security

Organization Dev
for Cyber Incident

Web Analysis

Exit Measures

Respond Seminar

SMBs

Target Attack e-mail training

Cybersecurity
Framework

Risk Consulting

Insurance

Cybersecurity・MS&AD Platform

Information Security analysis

Internal
Management
Organization•••

PolicyCyber Team
Budget &Resources

Identification ofCyber Risk oforganization andmap as ERM[Security Policy..]

External
Management•

External
contract andmanagement

Supply chain andOutsource control& management[Template of
NDA & Contract]

Web Analysis

Risk Identify•

Validation ofAsset tracking

Protect••••

Risk assessment
include evaluation[Asset list, Risk
evaluation sheet]

FirewallAccessManagement
Anti-Malware
Etc.

Exit Measures

Detect••Monitoring andlog
management
Etc.

Plan for the implementation ofremediation the prioritized by Risk
assessment. And monitoring process.
[Procedure of Cybersecurity
monitoring]Respond Seminar

Respond &Recover••Training
Respondaction andrecovery etc.

Recoverydocuments andreview by practices[Recovery
procedure & etc.]© MS&AD InterRisk Research & Consulting, Inc.

MS&AD InterRisk Research & Consulting, Inc.
Research & Market Development Section
Tel：+81-3-5296-8961／Fax：+81-3-5296-8940
https://www.irric.co.jp/en/corporate/© MS&AD InterRisk Research & Consulting, Inc.