Japan FSA Cybersecurity Guidelines for Financial Institutions 2.1.5-B: 2.1.5 Internal audit: basic actions

Internal audit, using external experts where needed, independently draws up a risk-based cybersecurity audit plan and audits cybersecurity (design and operation, response and recovery, legal compliance, third-party risk management); it reports significant findings without delay to the representative director and the board and tracks remediation accurately.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in 2.1 Cybersecurity management framework (governance) – Japan FSA Cybersecurity Guidelines for Financial Institutions

2.1.1-B 2.1.1 Basic policy and rules: basic actions
2.1.1-D 2.1.1 Basic policy and rules: desirable actions
2.1.2-B 2.1.2 Rules and business processes: basic actions
2.1.3-B 2.1.3 Resources and human talent: basic actions
2.1.4-B 2.1.4 Oversight by the risk management function: basic actions
2.1.4-D 2.1.4 Oversight by the risk management function: desirable actions
2.1.5-D 2.1.5 Internal audit: desirable actions

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Japan FSA Cybersecurity Guidelines for Financial Institutions controls