Japan FSA Cybersecurity Guidelines for Financial Institutions 2.3.4.3-B: 2.3.4.3 Security by design: basic actions

Practise security by design, building security requirements into financial products and services from planning and design, verifying risk across the whole service flow including critical third parties and taking measures; and confirm that critical third parties supplying systems can practise security by design (the Digital Agency's January 2024 guideline is the reference).

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in 2.3 Protection against cyberattacks – Japan FSA Cybersecurity Guidelines for Financial Institutions

2.3-B 2.3 Defence in depth: basic actions
2.3.1-B 2.3.1 Authentication and access management: basic actions
2.3.2-B 2.3.2 Education and training: basic actions
2.3.2-D 2.3.2 Education and training: desirable actions
2.3.3-B 2.3.3 Data protection: basic actions
2.3.3-D 2.3.3 Data protection: desirable actions
2.3.4.1-B 2.3.4.1 Hardware and software management: basic actions
2.3.4.1-D 2.3.4.1 Hardware and software management: desirable actions

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Japan FSA Cybersecurity Guidelines for Financial Institutions controls