Appendix 1. a) Outline of Cyber Exercises There are two types of cyber exercises. Table top exercises in which participants discuss countermeasures based on the scenario face-to-face, or via a telecommunication system; and functional exercises in which actual management issues are checked in a more realistic environment using real IT systems or a simulator. b) Table top exercises can be conducted at relatively lower costs, and they are a useful method for grasping the basic procedures of incident response and to recognize the issues involved. On the other hand, while the cost of functional exercises may be high, it has the advantage that you can check more detailed points in a real operational situation. c) It is preferable for CII operators to choose the appropriate style of exercise depending on the goals and items to be checked in the exercises. d) From the viewpoint of the participants, cyber exercises also can be divided into two further types, which are industry-level exercises and cross-industry exercises. In the industry-level exercises, participants come from only one industry, but participants from all related industries can join cross-industry exercises. e) The number of participants in the industry-level exercise is relatively few, therefore it is easy to set a scenario and contents, and even to conduct the exercise. This method is best suited for checking detailed items within an industry, although the effect on other industries and society cannot be sufficiently checked if a largescale cyber-attack was to occur. f) On the other hand, in the cross-industry exercises many industries are involved and the number of participants is larger, making it much harder to prepare for. The following results can be expected from cross-industry exercises: 1. Mutual understanding of the cross-industry threat 2. Enhancement of one industry’s measures through checking other industries which are interdependent with the first industry’s cyber-attack response system. 3. Improvement of the effectiveness of the information sharing system through establishing a human network between government and the private sector. g) In the implementation stage, one possibility is a step-up approach. In this approach, an industry-level exercise is conducted as a first step to clarify the issues in each industry. After understanding each industry’s preparation, cross-industry exercises are conducted to check the preparation of the other industries under larger scale cyber-attacks, considering interdependency among the related industries.