Japan FSA Cybersecurity Guidelines for Financial Institutions
The Financial Services Agency's Guidelines on Cybersecurity for the Financial Sector (October 2024): the cyber expectations the FSA inspects banks, insurers, securities firms, payment and crypto-asset businesses and other financial institutions in Japan against, split into basic actions for all and desirable actions for large institutions, with the May 2026 FSA and Bank of Japan request on frontier-AI threats and the 2026 supervisory expectations on phishing-resistant authentication and incident reporting. Read against the official Japanese texts.
Japan FSA Cybersecurity Guidelines for Financial Institutions is a compliance framework from Japan with 8 domains and 66 controls that map to 71 other frameworks. The largest domains are 2.2 Identification of cybersecurity risks – Japan FSA Cybersecurity Guidelines for Financial Institutions (19 controls), 2.3 Protection against cyberattacks – Japan FSA Cybersecurity Guidelines for Financial Institutions (14 controls), 2.5 Incident response and recovery – Japan FSA Cybersecurity Guidelines for Financial Institutions (9 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (8)
2.1 Cybersecurity management framework (governance) – Japan FSA Cybersecurity Guidelines for Financial Institutions
| Code | Title |
|---|---|
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.1.1-B | 2.1.1 Basic policy and rules: basic actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.1.1-D | 2.1.1 Basic policy and rules: desirable actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.1.2-B | 2.1.2 Rules and business processes: basic actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.1.3-B | 2.1.3 Resources and human talent: basic actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.1.4-B | 2.1.4 Oversight by the risk management function: basic actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.1.4-D | 2.1.4 Oversight by the risk management function: desirable actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.1.5-B | 2.1.5 Internal audit: basic actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.1.5-D | 2.1.5 Internal audit: desirable actions |
2.2 Identification of cybersecurity risks – Japan FSA Cybersecurity Guidelines for Financial Institutions
2.3 Protection against cyberattacks – Japan FSA Cybersecurity Guidelines for Financial Institutions
2.4 Detection of cyberattacks – Japan FSA Cybersecurity Guidelines for Financial Institutions
| Code | Title |
|---|---|
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.4-B | 2.4 Detection procedures: basic actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.4.1-B | 2.4.1 Monitoring: basic actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.4.1-D | 2.4.1 Monitoring: desirable actions |
2.5 Incident response and recovery – Japan FSA Cybersecurity Guidelines for Financial Institutions
| Code | Title |
|---|---|
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.5.1-B | 2.5.1 Incident response plan and contingency plan: basic actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.5.1-D | 2.5.1 Incident response plan and contingency plan: desirable actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.5.2.1-B | 2.5.2.1 Initial response (detection, intake, triage): basic actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.5.2.2-B | 2.5.2.2 Analysis: basic actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.5.2.3-B | 2.5.2.3 Customer response, internal and external coordination, public relations: basic actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.5.2.4-B | 2.5.2.4 Containment: basic actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.5.2.4-D | 2.5.2.4 Containment: desirable actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.5.2.5-B | 2.5.2.5 Eradication: basic actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.5.2.6-B | 2.5.2.6 Recovery: basic actions |
2.6 Third-party risk management – Japan FSA Cybersecurity Guidelines for Financial Institutions
| Code | Title |
|---|---|
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.6-B | 2.6 Third-party risk management: basic actions |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.6-D | 2.6 Third-party risk management: desirable actions |
Request of 22 May 2026: short-term measures against frontier-AI threats – Japan FSA Cybersecurity Guidelines for Financial Institutions
| Code | Title |
|---|---|
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::FAI.1 | Frontier AI request (1) Treat frontier AI as a management priority |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::FAI.2 | Frontier AI request (2) Identify priority services and IT systems |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::FAI.3 | Frontier AI request (3) Resolve technical debt in the identified assets |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::FAI.4 | Frontier AI request (4) Secure personnel for patching and triage |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::FAI.5 | Frontier AI request (5) Verify vendor maintenance contracts |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::FAI.6 | Frontier AI request (6) Adopt a risk-based patching process |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::FAI.7 | Frontier AI request (7) Strengthen measures beyond patching |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::FAI.8 | Frontier AI request (8) Prepare for disruption of priority services and systems |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::FAI.9 | Frontier AI request (9) Maintain and strengthen external collaboration |
Supervisory guideline expectations linked to the Guidelines – Japan FSA Cybersecurity Guidelines for Financial Institutions
| Code | Title |
|---|---|
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::SG.IB | Internet banking: phishing-resistant MFA and fraud prevention (supervisory guidelines, 27 February 2026) |
| japan-fsa-cybersecurity-guidelines-for-financial-institutions::SG.IR | Reporting system failures and cybersecurity incidents to the FSA (supervisory guidelines, forms from 1 October 2026) |
Your Compliance Coverage
If you comply with Japan FSA Cybersecurity Guidelines for Financial Institutions, you already cover:
US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule
4%
3 controls mapped
Compare →OWASP DevSecOps Maturity Model (DSOMM)
4%
3 controls mapped
Compare →ISO/IEC 27011:2024
4%
3 controls mapped
Compare →+ 68 more: FFIEC Cybersecurity Assessment Tool (CAT) (4%), Singapore Government Instruction Manual on ICT&SS Management (IM8) (4%)
See all 71 mapped frameworks ↓Maps to 71 other frameworks
Coverage is not the same as your position
This page shows what Japan FSA Cybersecurity Guidelines for Financial Institutions overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Japan FSA Cybersecurity Guidelines for Financial Institutions and who does it apply to?
Japan FSA Cybersecurity Guidelines for Financial Institutions is a compliance framework from Japan with 8 domains and 66 controls. The Financial Services Agency's Guidelines on Cybersecurity for the Financial Sector (October 2024): the cyber expectations the FSA inspects banks, insurers, securities firms, payment and crypto-asset businesses and other financial institutions in Japan against, split into basic actions for all and desirable actions for large institutions, with the May 2026 FSA and Bank of Japan request on frontier-AI threats and the 2026 supervisory expectations on phishing-resistant authentication and incident reporting. Read against the official Japanese texts. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Japan FSA Cybersecurity Guidelines for Financial Institutions actually require?
Japan FSA Cybersecurity Guidelines for Financial Institutions has 66 controls organised across 8 domains. The largest domains are 2.2 Identification of cybersecurity risks – Japan FSA Cybersecurity Guidelines for Financial Institutions (19 controls), 2.3 Protection against cyberattacks – Japan FSA Cybersecurity Guidelines for Financial Institutions (14 controls), 2.5 Incident response and recovery – Japan FSA Cybersecurity Guidelines for Financial Institutions (9 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Japan FSA Cybersecurity Guidelines for Financial Institutions do I already cover?
Japan FSA Cybersecurity Guidelines for Financial Institutions maps to 71 other compliance frameworks. The top mapping partners are US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule (4% coverage), OWASP DevSecOps Maturity Model (DSOMM) (4% coverage), ISO/IEC 27011:2024 (4% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Japan FSA Cybersecurity Guidelines for Financial Institutions?
Start your Japan FSA Cybersecurity Guidelines for Financial Institutions compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Japan FSA Cybersecurity Guidelines for Financial Institutions requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 66 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required