Policy Rulemaking Outages Maintenance and promotion of the safety principles Public announcement of measures for critical infrastructure protection Execution of BCP, Contingency plans, etc. Protection/recovery from CI services outage Issue identification through CI services outage response Issue identification through exercises and training Issue identification through results of research/analysis of IT environmental change Issue identification through internal/external audits Issue identification through operation of cybersecurity measures Check (verify) + Act (revise)/ identification and fixing issues Outages Establishment Critical infrastructure operator measure examples 11 Information sharing between publicprivate stakeholders (Cabinet Secretariat/responsible ministries for critical infrastructure) Information sharing Incident response Training by responsible ministries for critical infrastructure (Responsible ministries for critical infrastructure) CEPTOAR communication training (Cabinet Secretariat/responsible ministries for critical infrastructure) Cross-sectoral exercises (Cabinet Secretariat/responsible ministries for critical infrastructure) Government activities Figure "Critical Infrastructure Operator Measure Examples" and "Government Activities" Investigation and analysis of new risk sources and risks, etc. (Responsible ministries for critical infrastructure) Promotion of incident readiness (Cabinet Secretariat/responsible ministries for critical infrastructure) Review of the protection scope / Public relations / International cooperation / Promotion of security by design / Appeal to top management / Promotion of the developing human resources / maintenance of regulations (Cabinet Secretariat/responsible ministries for critical infrastructure) Resource management Enhancement of basis for critical infrastructure protection Promotion of monitoring and review (Responsible ministries for critical infrastructure) Dissemination of risk assessment (Cabinet Secretariat/responsible ministries for critical infrastructure) Risk communication and consultation (Cabinet Secretariat/responsible ministries for critical infrastructure) Risk management and preparation of incident readiness Continual improvement of guides for safety principles (Cabinet Secretariat/responsible ministries for critical infrastructure) Survey on activities under safety principles (Cabinet Secretariat) Continual improvement of the safety principles ( Secretariat/responsible ministries for critical infrastructure) Measures for outsourcing Design/procedure manual creation/maintenance related to operational cybersecurity measures Normal circumstances Design/implementation/maintenance related to technological cybersecurity measures Clarification and modification of cybersecurity requirements Public announcement of cybersecurity measures Operation of cybersecurity measures (Recognizing the trend of attack, etc.) Information sharing by stakeholders Management review of operation of cybersecurity measures Operation of cybersecurity measures (Monitoring/control) Do (actual operation)/ detection and recovery Normal circumstances Human resource development/assignment and accumulation of know-how Planning Provision of resources (budget, human resources, infrastructure) Information handling Establishment and revision of plan for cybersecurity measures Establishment and revision of roadmap for cybersecurity measures Basis BCP, Contingency Plans Internal rule (Cybersecurity policy, etc.) Determination and revision of operator's basic policy Risk assessment based on identified issues Plan (preparation)/ prevention and mitigation II. Executive Summary of This Cybersecurity Policy