III. Policies for CIP 4. Risk Management and Preparation of Incident Readiness If any new CI sectors are added, IT dependency studies will also be carried out along with interdependency analysis. 4.2.3 Promotion of incident readiness For mission assurance, in the event of CISs outages, CI operators are required to ensure the safety of affected CI services and restore them to an acceptable level within an acceptable period of time. Therefore, CI operators need to develop incident readiness in preparation for CISs outages. Given these, the Cabinet Secretariat promotes preparation of incident readiness by CI operators. Additionally, looking toward the Olympic and Paralympic games, the Cabinet Secretariat also promotes preparation of incident readiness by related parties. Concrete activities are as follows. (i) Promote CI operators' formulation of BCPs and contingency plans based on the concept of mission assurance, and establishment of organizational structures for implementing them; In order to avoid risks caused by a failure to implement BCPs and contingency plans as planned, also promote activities to give education and exercises for assuring and verifying the effectiveness of these plans (ii) Build a core organization responsible for the sharing of incident information among stakeholders ahead of the Olympic and Paralympic games (the "Olympic and Paralympic CSIRT (provisional title)"), and utilize knowledge obtained in the process of developing this organization, such as through the clarification of responsibilities of the government and stakeholders, as a legacy in carrying out activities mentioned in (i) above Contingency plans in this Cybersecurity Policy refer to plans formulated in advance with regard to policies, procedures, preparations, etc. for initial responses (emergency responses) to be taken by top management and officials, etc. immediately after CI operators recognize the occurrence or a possibility of CISs outages, and the intended purpose is to minimize influence of CISs outages through proper actions based thereon. Initial responses (emergency responses) include suspension of CI services for ensuring safety based on the nature of the respective CI and the results of risk assessment. BCPs refer to plans formulated in advance with regard to the CI service restoration levels, priorities, and other policies, procedures, preparations, etc. so as to ensure that CI operators can restore CI services affected by CISs outages to an acceptable level within an acceptable period of time from the viewpoint of mission assurance. 4.2.4 Promotion of risk communication and consultation Risk communication and consultation is defined as a "continual and iterative process that an organization conducts to provide, share or obtain information and to engage in dialogue with stakeholders regarding the management of risks."8 This process is necessary from the viewpoint of mission assurance for each organization in setting their purpose regarding CI services to be indicated as the maintenance level of their services and in making decisions regarding both risks facing such purpose and their risk management. In the coming interconnected and converged information society, this process is also important in consensus building between CI operators and stakeholders regarding the division of roles and responsibilities concerning risks and CI operators' fulfilment of their expected responsibilities in providing CI services. 8 JIS Q 31000:2010 24