The FSA Cybersecurity Maturity Self-Assessment Tool (Saiba Sekyuritii Jiko Hyouka Tool サイバーセキュリティ自己評価ツール) is the centrepiece annual assessment requirement for Japanese financial institutions + first introduced 2017 + significantly enhanced 2022 + sector-specific versions 2024. (1) Self-Assessment Structure: (a) ~150 cybersecurity controls across 6 domains - Governance + Risk Management + Asset Management + Detection + Response + Recovery; (b) Per-Control Maturity Rating (1-5 scale or NIST-style); (c) Evidence requirement per control; (d) Self-Assessment workbook submitted to FSA annually; (e) FSA peer benchmarking + sector-aggregate analysis returned to participating institutions. (2) Maturity Tier Framework: (a) Tier 1 (Basic / Foundational) - all financial institutions including small regional banks + small insurers + small securities firms - basic NIST CSF Identify + Protect + Detect; (b) Tier 2 (Enhanced) - mid-sized + business model complexity + regional bank holding + mid-sized insurer + mid-sized securities - full NIST CSF including Respond + Recover; (c) Tier 3 (Advanced) - mega-banks + 3 megabanks (MUFG + Sumitomo Mitsui + Mizuho) + Japan Post Bank + JBIC + Japan Bank for International Cooperation + DBJ Development Bank of Japan + systemically important insurers + major securities firms - advanced including Threat Hunting + Red-Team + Advanced Detection + Cyber Range. (3) Six Domains in Detail: (a) Governance Domain - Board oversight + CISO + Strategy + Policy + Three Lines of Defense; (b) Risk Management Domain - Risk Assessment + Treatment + Monitoring + Reporting + Inherent vs Residual; (c) Asset Management Domain - Inventory + Classification + Crown Jewels + Critical Systems mapping; (d) Detection Domain - SOC + SIEM + EDR + Threat Hunting + Indicators of Compromise (IoC); (e) Response Domain - Incident Response Plan + Playbooks + CSIRT + Communications + FSA Notification; (f) Recovery Domain - Business Continuity + Disaster Recovery + Backup + Lessons Learned. (4) Annual Submission Timeline: (a) Self-Assessment workbook published by FSA in March; (b) Institution completion by FY-end (March 31); (c) Submission to FSA by 30 June (extended to 30 September for some sectors); (d) FSA review June-November; (e) Aggregate sector benchmark report November; (f) Per-institution feedback for outliers; (g) FSA on-site inspection planning informed by results. (5) Plan-Do-Check-Act Continuous Improvement: (a) Plan - annual cybersecurity plan based on self-assessment gaps; (b) Do - implement controls + improvements; (c) Check - quarterly review + self-monitoring; (d) Act - corrective action + lessons learned; (e) Annual Self-Assessment repeats cycle. (6) FSA Inspection + Audit Integration: (a) FSA on-site inspection cycle (typically 2-4 years for major institutions); (b) Cybersecurity inspection module within general supervisory inspection; (c) Cyber Drill (Sai Bure Kunren サイブレ訓練) during inspection; (d) Documentation review + technical assessment + interview + observation; (e) Inspection findings + Improvement Order if material; (f) Public naming for serious deficiencies. (7) Sector-Specific 2024 Versions: (a) Banking Cybersecurity Guidelines + Banking Self-Assessment; (b) Insurance Cybersecurity Guidelines + Insurance Self-Assessment; (c) Securities Cybersecurity Guidelines + Securities Self-Assessment; (d) Asset Management Cybersecurity Guidelines + Self-Assessment; (e) Each sector has tailored controls reflecting sector-specific risks (e.g. Banking has internet banking authentication emphasis + Insurance has actuarial + Securities has trading systems). (8) International Benchmarking: (a) NIST CSF 2.0 mapping; (b) FFIEC Cybersecurity Assessment Tool comparison; (c) UK FCA Cyber and Operational Resilience SS1/21 alignment; (d) EU DORA Digital Operational Resilience Act 2022/2554 comparison; (e) Singapore MAS Technology Risk Management Guidelines; (f) Hong Kong HKMA Cyber Resilience Assessment Framework. (9) Self-Assessment Quality Indicators: (a) Honest self-assessment vs aspirational; (b) Evidence quality - documents + screenshots + logs; (c) Maturity progression year-over-year; (d) Gap remediation tracking; (e) Independent verification by Internal Audit; (f) Board awareness of self-assessment results. (10) Self-Assessment Misuse Risks: (a) Compliance theatre - high self-rating without substance; (b) FSA peer benchmark exposes outliers; (c) Discrepancy between self-rating and actual incident performance; (d) Regulatory follow-up + Improvement Orders + Inspection escalation. Coordinates with NIST CSF 2.0 + FFIEC Cybersecurity Assessment Tool + UK FCA SS1/21 + EU DORA + Singapore MAS TRMG + Hong Kong HKMA CRAF + FSA Inspection Manual + Plan-Do-Check-Act ISO standard + Three Lines of Defense IIA model + APPI + FISC Security Guidelines + Banking/Insurance/Securities/Asset Management sector tailoring. Japan FSA Cybersecurity Maturity Self-Assessment applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.