Japan FSA Cybersecurity Guidelines for Financial Institutions 2.1.1-B: 2.1.1 Basic policy and rules: basic actions

The board treats cybersecurity risk as part of enterprise-wide risk management and sets a basic cybersecurity policy covering at least the purpose and direction of security measures, how requirements of stakeholders (customers, local communities, shareholders, authorities) and laws are met, and management's commitment; recognising increasingly sophisticated attacks, it builds the necessary management framework and reviews it at least once a year with thorough verification and discussion (with external experts where needed). Management builds the organisation plus an early-warning information collection, sharing and analysis set-up through information-sharing bodies, attack monitoring such as a SOC (outsourcing allowed) and crisis management for attacks (reporting and public relations, an internal CSIRT); sets a cybersecurity strategy and action plan (including multi-year plans) under the policy, keeps it effective and sufficient, and revises it annually and on significant change; pursues security by design alongside new products, services and digital transformation; makes cybersecurity a key management issue and leads the culture, understanding critical operations (financial services whose disruption would seriously affect the institution, users or the financial system) and risks and driving measures, progress and resources; clarifies roles, responsibilities and authority, staffs so that sudden departures do not break continuity, and appoints a CISO or equivalent on management's responsibility; obtains at least annually reports on the cyber risk situation (own incidents, domestic, overseas and sector incidents, critical vulnerabilities), risk assessment results (external where needed) and plan progress; and improves the framework continuously in light of audits, stakeholder requirements and the environment.