Japan FSA Cybersecurity Guidelines for Financial Institutions 2.2.2.2-B: 2.2.2.2 Risk identification and assessment: basic actions

Set procedures for identifying and assessing cybersecurity risk; assess risk at least once a year from the likelihood of attacks (given threat and vulnerability information) and the impact on the business and information assets, and also when a serious threat or vulnerability emerges or a new product or service is launched; and consider perimeter breach and insider threats so that systems in internal network segments are in scope.