measures to ensure safe and secure realization of “new lifestyles.” In particular, the conventional “perimeter security model” is no longer adequate in some cases, so the national government will consider the suitable ways to design, operate, monitor and audit information systems under such cases as well as how to arrange structures and human resources that will help to handle them. - Given that the recent cyberattacks have become increasingly complex and sophisticated, security measures have to be taken considering the overall supply chain where some subcontractors, including overseas offices and SMEs, may not have adequate measures and so may be targeted by cyberattacks. Therefore, the national government will push forward with effective information security measures that address such new threats while assessing the effectiveness according to the size of the organization and other factors. - Specifically, as security measures aligned with the cloud-by-default principle, the national government will promote the revision and implementation of the unified government security standards in accordance with the expanding use of cloud services and consider enhancing the GSOC functions to enable cloud services’ monitoring. - Moreover, the national government will steadily implement the fourth GSOC (FY2021 to FY2024) and conduct technical reviews and revision of the unified government security standards toward the implementation of security architecture with the continuous diagnostics and response, not limited to the conventional “perimeter security model”, while initiatively promoting the implementation in the government agencies from where possible. Also, the national government will discuss the roles and functions of the GSOC in terms of measures to address information security. - The national government will strengthen the response to supply chain risks and IoT devices and services (including IoT of industrial control systems) in administrative areas. - The national government will implement security measures (e.g., authentication function, default settings of cloud services, vulnerability countermeasures) that should be adopted at the phases of the design and development of information systems. - The national government will maintain and improve the cybersecurity response among government agencies, etc. through security audits and CSIRT training, etc. 4. 2. 4 Promotion of efforts by stakeholders which underpin the socio-economic infrastructure (2) (Critical infrastructure) - Our nation’s economy and society depend on the continuous provision of various critical infrastructure services. Given the increasing interdependency between critical infrastructures and increasing complexity and globalization of supply chains, a safe and secure society cannot be realized without safeguarding the cybersecurity of critical infrastructure, which is subjected to threats that increase year after year, and enhancing its resilience. 22