* [Blog](https://www2.paloaltonetworks.com/blog) * [Palo Alto Networks](https://www2.paloaltonetworks.com/blog/corporate/) * [Cybersecurity](https://www2.paloaltonetworks.com/blog/category/cybersecurity-2/) * Japan's Cybersecurity Gui... # Japan's Cybersecurity Guidelines for Business Leadership -- Changing the Japanese Business Mindset and Potentially Raising the Global Bar [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2016%2F05%2Fjapans-cybersecurity-guidelines-for-business-leadership-changing-the-japanese-business-mindset-and-potentially-raising-the-global-bar%2F) [](https://twitter.com/share?text=Japan%E2%80%99s+Cybersecurity+Guidelines+for+Business+Leadership+%E2%80%93+Changing+the+Japanese+Business+Mindset+and+Potentially+Raising+the+Global+Bar&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2016%2F05%2Fjapans-cybersecurity-guidelines-for-business-leadership-changing-the-japanese-business-mindset-and-potentially-raising-the-global-bar%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2016%2F05%2Fjapans-cybersecurity-guidelines-for-business-leadership-changing-the-japanese-business-mindset-and-potentially-raising-the-global-bar%2F&title=Japan%E2%80%99s+Cybersecurity+Guidelines+for+Business+Leadership+%E2%80%93+Changing+the+Japanese+Business+Mindset+and+Potentially+Raising+the+Global+Bar&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www2.paloaltonetworks.com/blog/2016/05/japans-cybersecurity-guidelines-for-business-leadership-changing-the-japanese-business-mindset-and-potentially-raising-the-global-bar/&ts=markdown) \[\](mailto:?subject=Japan’s Cybersecurity Guidelines for Business Leadership – Changing the Japanese Business Mindset and Potentially Raising the Global Bar) Link copied By [Mihoko Matsubara](https://www.paloaltonetworks.com/blog/author/mihoko-matsubara/?ts=markdown "Posts by Mihoko Matsubara") and [Danielle Kriz](https://www.paloaltonetworks.com/blog/author/danielle-kriz/?ts=markdown "Posts by Danielle Kriz") May 13, 2016 7 minutes [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity-2/?ts=markdown) [Government](https://www.paloaltonetworks.com/blog/category/government/?ts=markdown) [cybersecurity](https://www.paloaltonetworks.com/blog/tag/cybersecurity/?ts=markdown) [IPA](https://www.paloaltonetworks.com/blog/tag/ipa/?ts=markdown) [Japan](https://www.paloaltonetworks.com/blog/tag/japan/?ts=markdown) [Japanese Ministry of Economy](https://www.paloaltonetworks.com/blog/tag/japanese-ministry-of-economy/?ts=markdown) [Japan's cybersecurity efforts](https://www.paloaltonetworks.com/blog/tag/japans-cybersecurity-efforts/?ts=markdown) [METI](https://www.paloaltonetworks.com/blog/tag/meti/?ts=markdown) *(This blog post is [also available in Japanese](https://www.paloaltonetworks.jp/company/in-the-news/2016/160516_Cyber_security_management_guidelines_of_Japan.html).)* In May 2015, 1.25 million pieces of personal information were [stolen by cyber thieves](http://www.japantimes.co.jp/news/2015/06/01/national/crime-legal/japan-pension-system-hacked-1-25-million-cases-personal-data-leaked/) from the Japan Pension Service (JPS). The news of the event reverberated throughout Japan similar to the headlines created after the Office of Personnel Management [hacking](https://www.opm.gov/news/releases/2015/06/opm-to-notify-employees-of-cybersecurity-incident/) a month later in the United States. The JPS event, on top of a recent series of information leaks, was shocking enough to raise cybersecurity awareness among corporate executives in Japan and shape Japan's cybersecurity posture. Seven months later, the Japanese Ministry of Economy, Trade and Industry (METI) and its Information-Technology Promotion Agency (IPA) released an impactful document: [*Cybersecurity Guidelines for Business Leadership* *Version 1.0*](http://www.meti.go.jp/press/2015/12/20151228002/20151228002-2.pdf) (this is a Japanese link; English press release is [here](http://www.meti.go.jp/english/press/2015/1228_03.html)). The 36-page document is aimed squarely at business executives, written in plain Japanese and eschewing technical terminology. The two organizations were alarmed by [PwC statistics](http://www.meti.go.jp/press/2015/12/20151228002/20151228002-2.pdf,%206) showing that only 27 percent of Japanese companies have business executives proactively instituting cybersecurity measures, compared to 59 percent globally. Since their release, the guidelines have struck a chord with the business community, with executives in Japan becoming increasingly keen to learn which cybersecurity measures their companies should take. Seminars about the guidelines have proliferated around Tokyo and other major cities, attracting audiences from management and the executive level---quite different from the typically technical audiences that, until now, have attended most cybersecurity events. And some key Japanese players have reacted with major initiatives. Keidanren, the Japanese Business Federation (akin to the U.S. Chamber of Commerce), responded immediately in January 2016 in its [second set of cybersecurity recommendations](http://www.keidanren.or.jp/policy/2016/006_honbun.html)) to the government, noting that industry is committed to reforming business leadership awareness and ensuring that cybersecurity is an important pillar of business risk management. Keidanren blazed a trail. This April, Fujitsu Ltd., the Japanese multinational IT and services company, published a company-wide cybersecurity policy based on the guidelines: [*Fujitsu Group* *Information Security Policy*](http://www.fujitsu.com/downloads/CSR/society/FujitsuGroupInformationSecurityPolicy010.pdf), which applies to the company's operations globally. We expect other major Japanese companies will follow suit with similar efforts, as Japanese companies culturally prefer to act in a uniform manner. For the non-Japanese reading audience, what does the document say? The Japanese government gets to the point in the *Cybersecurity Guidelines* introduction: cybersecurity is an integral part of business operations and a priority for leadership, thus businesses must make decisions on their IT and cybersecurity investments to ensure business continuity and protect the company's intellectual property and other assets. The document then provides **three principles** about which business executives should be aware, and **10 action items** they should require their CISO and security teams to complete. The **three principles** are that executive leadership should: * Take the leadership to invest in cybersecurity, based on the level of risk they deem acceptable to their business operations; * Enact cybersecurity measures for their own company, and promote measures in affiliated companies and business partners to mitigate potential information breaches; and * Communicate their cybersecurity measures to stakeholders, take accountability, and build confidence. The **10 action items** elucidate more specific measures to take and demand teamwork among executives, technical professionals, and non-technical people. Leadership should instruct CISOs to: 1. Craft a cybersecurity policy; 2. Establish an appropriate team and clarify the division of responsibilities; 3. Identify assets to protect, and potential risks to those assets, and craft a mitigation plan; 4. Implement the Plan-Do-Check-Act (PDCA) cycle; 5. Have subsidiaries and business partners also do a PDCA; 6. Ensure an appropriate budget and human resource allocation; 7. Categorize assets as those the company should protect on its own, versus those outsourced contractors should protect, given capacity and efficiency; 8. Actively participate in and contribute to cyber threat information sharing frameworks; 9. Establish an emergency response system and conduct cyber exercises; and 10. Identify in advance whom to notify about potential incidents. Although not legally binding, the *Cybersecurity Guidelines* have presented a baseline expectation from the Japanese government to industry. And, in Japan, government expectations carry significant weight, as do the actions of one's contemporaries. Couple these cultural norms with a growing realization among Japanese companies (similar to their global peers) of the need to improve cybersecurity, and there is strong foundation for change. The timing of the release of the METI/IPA *Cybersecurity Guidelines* also was essential to the rapid comprehension among Japanese companies of their value. After the JPS case, Japan's [revised Personal Information Protection Act](https://www.aohub.com/aohub/viewContent.action?key=Ec8teaJ9VapLtjO8pfPqXV7eOOGbnAEFKCLORG72fHz0%2BNbpi2jDfaB8lgiEyY1JAvAvaah9lF21%0D%0ACiGG39vtfQ%3D%3D&nav=FRbANEucS95NMLRN47z%2BeeOgEFCt8EGQ%2FHLCIrtYuIY%3D&uid=frsvcLdHNrI%3D&popup=HxapDW%2FMKd4%3D&videoId=0&freersslink=true) came into effect in September 2015, requiring all companies to take security measures to protect and prevent breaches of personal information. Finally, in January 2016 "[My Number](https://www.kojinbango-card.go.jp/en/mynumber/)," a new personal identification system for Social Security and taxation information, was launched. This all was on top of new legal risks following the 2014 "Benesse Corporation" case in which a leading Japanese correspondence education services provider and publisher paid ¥20 billion (approximately $187 million) in a class-action customer lawsuit after a systems engineer working for its subsidiary [sold 35 million pieces of customer information](http://www.japantimes.co.jp/news/2015/01/05/national/more-plaintiffs-join-damages-suit-over-benesse-data-leak/) to name-list brokers. The case ran afoul of the [Japanese Companies Act](https://thefinance.jp/law/150630), which requires C-level people, such as Chief Information Officers and Chief Financial Officers, to ensure internal controls, including information security. The guidelines have been a potent force over the last five months in encouraging Japanese companies to release or prepare new cybersecurity policies, many of which will impact both Japanese and non-Japanese business partners. Given the potential global influence, it would be beneficial for the METI/IPA *Cybersecurity Guidelines* to be translated into English. This also will enable a global audience to better understand the direction in which Japan's cybersecurity is heading, share best practices and potentially comment on the guidelines, and maximize the chances that government efforts are aligned internationally. We have seen this approach to send messages globally bear fruit very recently. When the Japanese National Center of Incident Readiness and Strategy for Cybersecurity (NISC), a governmental organization responsible for cybersecurity strategy and policy-crafting and international coordination, published Japan's National Cybersecurity Strategy in 2015, it released Japanese and English versions at around the same time. This was a trial for the Japanese government, which traditionally has taken several months to release English translations of documents, if at all. This important move reflected Japan's strong determination to make a globally impactful strategy rather than potentially limiting its influence to just within Japan. No single country, sector or company can improve cybersecurity on its own. Teamwork and communication are essential. The METI/IPA *Cybersecurity Guidelines* are a very welcome addition to the mix. Many global companies including Palo Alto Networks have been strong advocates of government efforts to promote sound cybersecurity policies that enable entities to assess and manage their cyber risks, and that are based on public-private partnerships. Japan is the third largest economy in the world, and its efforts to improve cybersecurity are globally impactful. Japan's new *Cybersecurity Guidelines* deserve a global audience. [![MihokoMatsubara](https://www.paloaltonetworks.com/blog/wp-content/uploads/2016/08/MihokoMatsubara.jpg)](https://www.paloaltonetworks.com/blog/wp-content/uploads/2016/08/MihokoMatsubara.jpg)[](https://www.paloaltonetworks.com/blog/wp-content/uploads/2016/08/Headshot_Danielle-Kriz.jpg) [![Headshot\_Danielle Kriz](https://www.paloaltonetworks.com/blog/wp-content/uploads/2016/08/Headshot_Danielle-Kriz.jpg)](https://www.paloaltonetworks.com/blog/wp-content/uploads/2016/08/Headshot_Danielle-Kriz.jpg) *This is the first in a [series of blogs to be co-authored by Mihoko Matsubara and Danielle Kriz](https://www.paloaltonetworks.com/blog/tag/japans-cybersecurity-efforts/) aimed at introducing Japan's cybersecurity efforts and their significance to a global audience, including governments, global industry, and other thought leaders. Subsequent blogs are expected to cover additional thoughts on the METI/IPA Cybersecurity Guidelines, the G7 Summit hosted by Japan in late May 2016, Japan's role in global cybersecurity capacity-building, cyberthreat information-sharing and prospects for Japan, the cybersecurity ramifications of planning for the Tokyo Olympic Games 2020, and other topics.* *** ** * ** *** ## Related Blogs ### [CSO Perspective](https://www.paloaltonetworks.com/blog/category/cso-perspective/?ts=markdown), [Government](https://www.paloaltonetworks.com/blog/category/government/?ts=markdown) [#### Japanese Government Updates Cybersecurity Guidelines: Increased Focus on Cybersecurity Investments and SMBs](https://www2.paloaltonetworks.com/blog/2016/12/gov-japanese-government-updates-cybersecurity-guidelines-increased-focus-cybersecurity-investments-smbs/) ### [CSO Perspective](https://www.paloaltonetworks.com/blog/category/cso-perspective/?ts=markdown) [#### The "Safe" Zone and Other Challenges to Japan's Cybersecurity Governance Efforts](https://www2.paloaltonetworks.com/blog/2016/09/cso-the-safe-zone-and-other-challenges-to-japans-cybersecurity-governance-efforts/) ### [AI Governance](https://www.paloaltonetworks.com/blog/category/ai-governance/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity-2/?ts=markdown), [Government](https://www.paloaltonetworks.com/blog/category/government/?ts=markdown), [Public Sector](https://www.paloaltonetworks.com/blog/category/public-sector/?ts=markdown) [#### Improving National Security Through Secure AI](https://www2.paloaltonetworks.com/blog/2025/05/improving-national-security-through-secure-ai/) ### [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity-2/?ts=markdown), [Government](https://www.paloaltonetworks.com/blog/category/government/?ts=markdown), [Public Sector](https://www.paloaltonetworks.com/blog/category/public-sector/?ts=markdown) [#### Making Every Dollar Count for Federal Cybersecurity](https://www2.paloaltonetworks.com/blog/2025/03/making-every-dollar-count-federal-cybersecurity/) ### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Government](https://www.paloaltonetworks.com/blog/category/government/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown) [#### The UK's National Cyber Strategy 2022 -- An Evolution](https://www2.paloaltonetworks.com/blog/2022/01/the-uks-national-cyber-strategy-2022/) ### [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity-2/?ts=markdown), [Data Security](https://www.paloaltonetworks.com/blog/category/data-security/?ts=markdown), [Data Security](https://www.paloaltonetworks.com/blog/network-security/category/data-security/?ts=markdown), [Web Security](https://www.paloaltonetworks.com/blog/category/web-security/?ts=markdown) [#### The True Cost of Cybersecurity Incidents: The Solution](https://www2.paloaltonetworks.com/blog/2021/07/investing-in-cybersecurity-now-can-save-money-later/) ### Subscribe to the Blog! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www2.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language