Japan FSA Cybersecurity Guidelines for Financial Institutions 2.5.2.3-B: 2.5.2.3 Customer response, internal and external coordination, public relations: basic actions

Make sure the CISO, staff and everyone in each contingency plan (including third-party staff) know their roles, contacts and procedures; tell affected customers the scope, precautions and remedies when leaks or other events could cause them secondary harm; report promptly to regulators under laws and regulations (for banks the supervisory guideline asks for an immediate report on recognising a system failure or cybersecurity incident, now on the government's common forms, see SG.IR); publish known facts on damage, response and recovery prospects appropriately and promptly where law requires or where it prevents secondary harm or protects customers, taking security risks into account; and share attackers' TTPs and other useful technical information, minus confidential details, with Financials ISAC, JPCERT/CC and similar bodies (the NISC March 2023 guidance on sharing and publishing attack information is the reference).