The Japan Financial Services Agency (FSA 金融庁) Cybersecurity Guidelines (Saiba Sekyuritii ni kansuru Gaidorain サイバーセキュリティに関するガイドライン) are the foundational cybersecurity regulatory framework for Japanese financial institutions + first issued July 2015 + revised 2019 + 2022 + sector-specific revisions 2024. (1) Issuing Body: Japan Financial Services Agency (FSA) Supervisory Coordination Division + Securities and Exchange Surveillance Commission (SESC) + IT Division. (2) Statutory Authority: (a) Banking Act Article 52-2 + Insurance Business Act Article 100-2 + Financial Instruments and Exchange Act Article 19; (b) Cybersecurity Basic Act 2014 (Saiba Sekyuritii Kihon Hou サイバーセキュリティ基本法); (c) NISC National Center of Incident Readiness and Strategy for Cybersecurity coordination; (d) FSA Inspection Manual sector-specific cybersecurity provisions. (3) Scope Coverage: applies to (a) Banks - city banks + regional banks + trust banks + shinkin banks + credit unions; (b) Insurance - life insurance + non-life insurance + small-amount short-term insurance; (c) Securities - securities firms + investment advisors + financial instruments business operators; (d) Funds - asset management + investment trusts; (e) Payment + Settlement - cryptoassets exchange + payment service providers + funds transfer; (f) Holding Companies - bank holding + insurance holding; (g) Special purpose entities + branch offices of foreign financial institutions. (4) Key Evolution Timeline: (a) 2015 - Initial Cybersecurity Guidelines following Tokyo Stock Exchange and Mizuho Bank cyber incidents; (b) 2019 Revision - threat intelligence + supply chain + zero trust elements + APPI integration; (c) 2022 Revision - cloud computing + remote work post-COVID + ransomware-specific; (d) 2024 Revision - sector-specific (Banking Cybersecurity Guidelines + Insurance Cybersecurity Guidelines + Securities Cybersecurity Guidelines + Asset Management Cybersecurity Guidelines) + generative AI + post-quantum cryptography readiness + Critical Information Infrastructure designation alignment. (5) Three Lines of Defense Model: (a) First Line - business operations + IT operations + first-line risk management; (b) Second Line - Risk Management + Compliance + CISO Chief Information Security Officer office; (c) Third Line - Internal Audit independent assurance. (6) Board and Senior Management Oversight Expectations: (a) Cybersecurity Strategy approved by Board; (b) CISO appointment + Board access; (c) Quarterly Cybersecurity Risk Report; (d) Annual Cybersecurity Self Assessment review; (e) Cyber Risk in Enterprise Risk Management; (f) Incident escalation criteria + Board notification thresholds; (g) Cyber Insurance review; (h) ESG cyber metric integration; (i) Tone-at-the-top commitment statement. (7) Maturity-Based Approach: (a) Tier 1 - basic cybersecurity foundational - all financial institutions; (b) Tier 2 - enhanced cybersecurity - mid-sized + business model complexity; (c) Tier 3 - advanced cybersecurity - mega-banks + systemically important financial institutions + critical infrastructure operators; (d) Self-Assessment per maturity tier + annual progression. (8) Sector-Specific Considerations: (a) Banking - Internet Banking Authentication per BoJ + Account Takeover Protection + ATM Skimming + Payment Fraud + Card Skimming + Authorised Push Payment fraud; (b) Insurance - claim processing + customer data + actuarial systems; (c) Securities - order management + market access + algorithmic trading systems; (d) Asset Management - investment management + custody integration; (e) Payment Service Providers - real-time payment + Zengin System + Japan Bankers Association payment infrastructure + cryptoasset exchange (FSA + FIEA Article 63-9-2). (9) FISC Coordination: (a) FISC Center for Financial Industry Information Systems (金融情報システムセンター) industry self-regulatory body; (b) FISC Security Guidelines for Computer Systems in Financial Institutions (FISC Anzen Taisaku Kijun 安全対策基準) - foundational technical baseline; (c) FISC + FSA joint working groups; (d) FISC Information Sharing Program + threat intelligence; (e) FISC Industry Drills + Delta Wall annual exercise. (10) International Coordination: (a) NIST CSF crosswalk + FSA reference; (b) FFIEC IT Examination Handbook reference; (c) BCBS Basel Committee on Banking Supervision Principles for Cyber Resilience; (d) CPMI-IOSCO Guidance on Cyber Resilience for Financial Market Infrastructures; (e) G7 Fundamental Elements of Cybersecurity for the Financial Sector (October 2016); (f) FSB Financial Stability Board Cyber Lexicon + Effective Practices for Cyber Incident Response and Recovery (October 2020); (g) Bilateral FSA arrangements with US OCC + Federal Reserve + UK FCA + EBA + ECB + Bank for International Settlements. (11) Coordination with Other Japan Regulations: (a) APPI Act on Protection of Personal Information + PIPC; (b) Cybersecurity Basic Act 2014 + NISC; (c) JFIPA Japan Financial Industry Protective Association payment security; (d) Crime Proceeds Transfer Prevention Act 2007 + AML/CFT + JAFIC; (e) Anti-Money Laundering Office (AMLO) + Financial Action Task Force (FATF) on Money Laundering Recommendations; (f) Telecommunications Business Act + MIC + Cyber Incident Reporting; (g) ISMAP Information System Security Management and Assessment Program (Japan FedRAMP equivalent); (h) Japan AI Bill + FSA AI Guidelines for Financial Services (September 2024). (12) Recent Enforcement Trends: (a) Regional bank cybersecurity gaps post-COVID; (b) Cryptoasset exchange enforcement (Coincheck 2018 + others); (c) Cloud + Third-Party concentration risk; (d) Ransomware response readiness; (e) Generative AI deployment in customer-facing systems; (f) Cross-border payment cybersecurity. Coordinates with FSA Inspection Manual + Banking Act Article 52-2 + Insurance Business Act Article 100-2 + Financial Instruments and Exchange Act Article 19 + Cybersecurity Basic Act 2014 + NISC + FISC + FS-ISAC Japan + CCFI Center for Financial Industry Information Systems + APPI + PIPC + Crime Proceeds Transfer Prevention Act 2007 + JAFIC + FATF + JFIPA + ISMAP + ISO/IEC 27001 + 27002 + 27017 + 27018 + 27701 + NIST CSF 2.0 + FFIEC IT Examination Handbook + BCBS Principles for Cyber Resilience + CPMI-IOSCO Cyber Resilience FMI + G7 Fundamental Elements Financial Cybersecurity + FSB Cyber Lexicon + Bilateral FSA arrangements US/UK/EU. Japan FSA Cybersecurity Guidelines Scope + Governance applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.