Japan FSA Cybersecurity Guidelines for Financial Institutions 2.1.1-D: 2.1.1 Basic policy and rules: desirable actions

So that management can make sound decisions, make sufficient cybersecurity expertise available (including external experts), with clear roles across the three lines of defence and a verification mechanism using external experts; the board places cybersecurity risk within integrated risk management and sets risk appetite and risk tolerance (the minimum service level to maintain for critical operations on the premise that disruption will occur; the FSA's April 2023 operational resilience paper is the reference); management publicly states, as far as possible and without aiding attackers, the significance of its cybersecurity efforts (for example basic policy, service scope and levels to maintain, risk management structure, the security officer's expertise, resources, risk identification and planning, emergency and recovery set-up, incident occurrence); management obtains at least twice a year reports on cybersecurity KPIs (for example targeted-email drill reporting rate, vulnerability remediation rate, asset inventory progress, training completion) and KRIs (attack attempts, audit findings, incidents, open vulnerabilities); and management appoints a CISO with sufficient knowledge and experience who reports directly to management day to day, communicates directly with the top in normal times and crises, and has the support, authority and resources to do so, with officers in business units who bridge to the CISO.