Japan FSA Cybersecurity Guidelines for Financial Institutions JP-FSA-CYB-Third-Party-Outsourcing-Cyber-Risk-Cloud-Service-Provider-Due-Diligence-Audit-Right-Sub-Processor-Visibility-Concentration-Risk: Japan FSA Cybersecurity Third Party + Outsourcing Cyber Risk + Cloud Service Provider Due Diligence + Audit Right + Sub-Processor Visibility + Concentration Risk + Data Sovereignty + ISMAP Certification + FISC Cloud Guidelines

Third-Party + Outsourcing + Cloud Service Provider cybersecurity is critical per FSA Cybersecurity Guidelines + FISC Cloud Guidelines (FISC Anzen Taisaku Kijun - Cloud Computing Edition). (1) Outsourcing Governance: (a) Outsourcing Policy + Board Approval; (b) Per-Engagement Risk Assessment; (c) Critical vs Non-Critical Classification; (d) Due Diligence proportionate to risk; (e) Contractual obligations + KPIs; (f) Ongoing Monitoring; (g) Periodic Reassessment; (h) Termination + Transition planning. (2) Cloud Service Provider (CSP) Due Diligence: (a) AWS + Microsoft Azure + Google Cloud + Oracle + IBM Cloud + domestic (NTT Cloud + Fujitsu + NEC); (b) Financial Stability + Track Record; (c) Compliance Certifications - ISO 27001 + 27017 + 27018 + 27701 + SOC 2 + ISMAP + FedRAMP equivalent; (d) Data Residency - Japan-only + Asia-Pacific + Global; (e) Encryption + Customer-Managed Keys (CMK); (f) Hyperscaler vs domestic considerations; (g) Multi-Region + Multi-AZ for resilience. (3) FISC Cloud Computing Guidelines: (a) FISC Security Guidelines for Financial Institutions Cloud Computing Edition; (b) Shared Responsibility Model clarity; (c) IaaS + PaaS + SaaS responsibility delineation; (d) Cloud-specific technical baselines; (e) FISC Cloud Working Group + periodic updates. (4) ISMAP Information System Security Management and Assessment Program: (a) Japan Government Cloud certification program (Japan FedRAMP equivalent); (b) ISMAP for Cloud Services Catalogue; (c) Three tiers - LIU Limited / Standard / Critical; (d) FSA-regulated entities increasingly use ISMAP-certified cloud; (e) Audit + certification process. (5) Contractual Obligations: (a) Cybersecurity standards alignment (NIST CSF + ISO 27001); (b) Audit Right - on-site + remote; (c) Sub-Processor authorisation + flow-down; (d) Incident Notification - 24-hour typical; (e) Data Return + Deletion at termination; (f) Cooperation with FSA + supervisory engagement; (g) Service Level Agreement + cybersecurity SLAs; (h) Indemnification + Liability allocation; (i) Termination Rights including security material breach; (j) Exit Plan + Transition Assistance. (6) Sub-Processor + Chain Visibility: (a) Sub-Processor disclosure + approval; (b) Concentration in sub-processor chain; (c) Cascading risk; (d) Open source dependencies + supply chain attack; (e) Software supply chain (SBOM); (f) Vendor risk tiers + due diligence depth. (7) Concentration Risk Management: (a) Single Vendor dependency analysis; (b) Cloud Provider concentration (AWS/Azure/GCP majority); (c) Critical service single point of failure; (d) Geographic concentration; (e) Multi-cloud + multi-vendor strategy; (f) Exit feasibility + portability; (g) FSA concentration risk monitoring at sector level. (8) Data Sovereignty + Cross-Border: (a) APPI Article 24 cross-border restrictions; (b) Customer-managed encryption + cloud-region selection; (c) Lawful Access by foreign authorities concerns (US CLOUD Act + China NSL + similar); (d) Sovereign Cloud offerings (Microsoft Sovereign Cloud + AWS Sovereign Cloud + emerging); (e) Government Cloud (Japan Government Cloud per ISMAP). (9) Cybersecurity Testing of Third Parties: (a) Vendor pen testing + vulnerability scanning rights; (b) SOC 2 / ISO 27001 evidence; (c) Tabletop with vendor; (d) Joint incident response exercises; (e) Vendor security questionnaire (CAIQ + HECVAT + custom); (f) Continuous monitoring (BitSight + SecurityScorecard + RiskRecon ratings); (g) Threat intel on vendors (compromise indicators). (10) Outsourcing Concentration at Sector Level: (a) FSA monitors sector-wide concentration; (b) Systemic risk from common cloud providers; (c) FSA + FISC + Bank of Japan coordinated oversight; (d) Pandemic + geopolitical scenario planning; (e) Operational resilience focus per BCBS + CPMI-IOSCO. (11) Open Banking + Open API Specific: (a) Third-Party Provider (TPP) ecosystem; (b) Banking API authentication + authorisation; (c) PSD2-equivalent considerations (Japan does not have PSD2 directly but similar principles); (d) Customer consent management; (e) Open Banking risk + opportunity. (12) Recent Enforcement Themes: (a) Cloud provider outages impacting banks; (b) Third-party data breaches; (c) Supply chain attacks (e.g. SolarWinds-style); (d) Sub-processor visibility gaps; (e) Concentration risk over-reliance on single CSP. Coordinates with FISC Cloud Computing Security Guidelines + ISMAP Information System Security Management and Assessment Program + APPI Article 24 + Banking Act outsourcing rules + Insurance Business Act outsourcing + ISO/IEC 27001/27017/27018/27036 Supplier Relationships + ISO/IEC 22301 BCMS + SOC 2 Trust Services Criteria + Cloud Security Alliance CCM + STAR Registry + BCBS Principles for Operational Resilience + CPMI-IOSCO + FSB + EU DORA + UK FCA SS1/21 + Hyperscaler cloud providers + ISMAP certified Japan cloud catalogue + Sovereign Cloud emerging offerings. Japan FSA Cybersecurity Third Party + Cloud applies.