Cybersecurity Management Guidelines: Three Principles and Ten Key Actions

What the guidelines cover

Japan’s Ministry of Economy, Trade and Industry (METI) and Information-technology Promotion Agency (IPA) developed these guidelines to help executives lead cybersecurity management. This article covers Version 3.0, published in March 2023; its official English translation was released in May 2023.

The intended audience includes executives of large enterprises and SMEs (excluding small-scale enterprises) that supply IT systems or services or rely on IT in their business strategy. The document also explains that organizations using digital technologies or connected through supply chains need to consider cybersecurity risks regardless of their size.

The framework combines three principles for executives with ten instructions to the Chief Information Security Officer (CISO) or another responsible executive. Leaders set direction, assign responsibility, fund the work, and review results.

This article has been checked against both the Japanese original and the official English PDF. The ten action headings use the official English titles. Explanations are summaries, and implementation examples are editorial suggestions.

Cybersecurity is an essential investment and an executive responsibility

The explanation of principle 1 states that cybersecurity investment helps reduce business costs and losses, and executives are responsible for bringing the risk remaining after controls to an acceptable level.

Residual risk means risk that remains after safeguards have been implemented. For example, having backups without testing restoration leaves uncertainty about whether operations can recover. A practical approach is to document remaining risks, proposed improvements, acceptance decisions, and the decision owner. When establishing acceptable risk levels, consider sector guidance and requirements from business partners.

Source: Official English PDF, chapter 2, principle 1; and the outline.

Three principles executives should understand

1. Lead cybersecurity as a business risk. Incorporate it into enterprise risk management and make decisions about priorities and resources.
2. Consider the whole supply chain. Include domestic and overseas operations, partners, and contractors whose incidents may affect your business. This includes cloud services, API integrations, equipment maintenance, and disposal of information-bearing media. Weaknesses in your organization can also enable attacks against others.
3. Communicate in normal operations and during crises. Build relationships and exchange information with stakeholders inside and outside the organization.

Source: Official English PDF, chapter 2.

Ten key cybersecurity management actions

1. Recognize cybersecurity risks and develop an organization-wide policy

Understand the business consequences of cyber incidents. Establish and publicly communicate the organization’s cybersecurity policy.

Example: Review relevant incidents at other businesses and approve a policy that makes executive involvement explicit.

Source: Official English PDF, chapter 3.

2. Build a management system for cybersecurity risk

Define roles and accountability, and align cybersecurity management with existing governance, internal controls, and risk management.

Example: Identify the responsible executive, business owners, and IT responsibilities; establish escalation routes. Smaller organizations can assign combined roles with explicit accountability.

Source: Official English PDF, chapter 3.

3. Secure resources (budget, workforce, etc.) for cybersecurity measures

Allocate resources to keep residual risk within acceptable limits. Develop security skills appropriate to employees’ and executives’ responsibilities.

Example: Fund ongoing monitoring, operations, and education alongside technology purchases. Use external specialists when required skills are unavailable internally.

Source: Official English PDF, chapter 3.

4. Identify cybersecurity risks and develop plans to address them

Identify important information, services, and digital environments. Evaluate threats and business impacts for your organization and the products and services you provide, including mistakes and insider misconduct. Plan responses and identify residual risk.

Example: Prioritize customer-data exposure and critical-service outages; assign owners and deadlines. Consider specialist support and insurance where appropriate. Consider risk reduction, avoidance, and transfer, and explicitly identify risks left untreated. Cloud services and insurance do not eliminate all retained risk.

Source: Official English PDF, chapter 3.

5. Establish systems to effectively address cybersecurity risks

Implement safeguards and mechanisms to detect and analyze suspicious activity. Review them as the business environment and risks change.

Example: Combine multifactor authentication, restricted privileges, vulnerability management, endpoint protection, and log monitoring. Review cloud configurations and responsibility boundaries. Retain internal skills to understand outsourced security reports and act on their findings.

Source: Official English PDF, chapter 3.

6. Continuously improve cybersecurity measures through a PDCA cycle

Use Plan–Do–Check–Act to assess and improve controls. Provide regular executive reporting and appropriate disclosure of improvement efforts.

Example: Review overdue actions, unresolved major risks, and exercise findings; assign responsibility and deadlines for corrective work.

Source: Official English PDF, chapter 3.

7. Develop a cybersecurity incident response team and relevant procedures

Prepare to identify impact, limit damage, and prevent recurrence across the supply chain, including control systems. Identify notification recipients and disclosure content, and enable executives to explain the situation internally and externally. Conduct practical exercises.

Example: Assign an incident response team, define contacts and evidence-preservation procedures, and rehearse escalation with legal, communications, and relevant suppliers. Product and service providers should also consider a product security incident response team (PSIRT) or an equivalent capability.

Source: Official English PDF, chapter 3.

8. Develop a business continuity and recovery team and relevant procedures in preparation for damage due to cyber incidents

Set recovery objectives, procedures, and responsibilities based on business impact. Align them with the business continuity plan, considering industrial control systems and supply-chain dependencies where relevant.

Example: Prioritize service restoration and test backup recovery. Verify that business processes can resume, and check recurrence-prevention measures before recovery. Exercise scenarios involving unavailable suppliers or normal communication channels.

Source: Official English PDF, chapter 3.

9. Understand the status of and implement measures considering the entire supply chain, including business partners and outsourcing organizations

Understand security arrangements at relevant operations, partners, and contractors. Clarify responsibilities in contracts and consider joint measures or support.

Example: Identify critical suppliers, assess their safeguards, agree on incident notification, and review subcontracting arrangements. Help close important gaps when necessary.

Source: Official English PDF, chapter 3.

10. Facilitate the gathering, sharing and disclosure of information on cybersecurity

Build reciprocal information-sharing relationships, use intelligence to improve defenses, and prepare for incident reporting and public communication.

Example: Participate in sector information-sharing activities, route vulnerability alerts to responsible teams, and establish approval procedures for sharing or publishing incident information.

Source: Official English PDF, chapter 3.

Turning the framework into a working plan

The guidelines group the ten instructions into five areas. The evidence column below is an editorial implementation aid.

Area	Instructions	Example evidence
Direction and resources	1–3	Approved policy, responsibilities, budget, training plan
Risk treatment and improvement	4–6	Risk register, treatment plan, assessment and improvement records
Response and recovery	7–8	Response procedures, contacts, recovery plan, exercise results
Supply-chain security	9	Supplier reviews, contracts, improvement support records
Stakeholder communication	10	Information gathering, sharing, and disclosure procedures

Start by assigning accountability and identifying critical services and information. Assess gaps against all ten actions, then agree on owners, deadlines, funding, and executive review arrangements.

Although developed for Japanese enterprises, the framework offers a useful management structure elsewhere. Organizations outside Japan should adapt reporting arrangements and stakeholder coordination to their own local requirements.

Appendix A provides check sheets for the three principles and ten instructions. Executives and responsible officers can use them together to identify gaps and support management discussions.

Official resources

The official English PDF lets readers consult the guidelines without relying on Japanese-language material.

• Official English translation: Cybersecurity Management Guidelines Ver3.0
• Japanese original: Version 3.0
• METI: Guidelines and supporting tools (Japanese)
• IPA: Practical implementation resources (Japanese)

METI’s supporting-resource page also links to a self-assessment tool and guidance on building cybersecurity teams and securing personnel.