Japan FSA Cybersecurity Guidelines for the Financial Sector

Japan’s Financial Services Agency (FSA) published its Guidelines on Cybersecurity in the Financial Sector on 4 October 2024. They set out the points the regulator considers when examining cybersecurity management at financial institutions. The scope includes banks, securities firms (financial instruments business operators), insurers, payment firms, crypto-asset exchanges, and other specified financial-sector entities. They are a common reference for many Japanese banks and securities firms when building and reviewing their controls; this is a description of their sector-wide relevance, not a claim about a measured adoption rate.

The original document is public and anyone can read it, although the FSA PDF is in Japanese. This article explains the actions in English so readers can understand the approach without reading Japanese. It is a practical summary, not an official translation or a substitute for the complete regulatory text.

How the framework works

The core sequence is governance and management arrangements → identify risks → protect → detect → respond and recover (sections 2.1–2.5). Third-party risk management runs across these activities (section 2.6). Chapter 3 describes how the FSA works with other bodies on information sharing and coordination.

The FSA distinguishes basic response items (foundational measures financial institutions generally need to implement) from desirable response items (additional good practices, including those especially relevant to larger or more consequential institutions). Neither category prescribes exactly the same implementation for every organization: assess your business, size, critical services, threats and risk tolerance, then prioritize controls proportionate to the risks (section 1.1). The actions below mainly summarize the basic items; examples specifically identified as desirable are labeled as such.

1. Establish governance (section 2.1)

1. Have the board or equivalent approve a cybersecurity policy and treat cyber risk as part of enterprise risk management. Management should approve a strategy and an action plan with measures, owners, timelines, staffing and resources. Review the management arrangements at least annually, and update plans annually and when significant changes occur.
2. Appoint an accountable senior cybersecurity leader, such as a CISO. Define authority, reporting lines, and responsibilities across business, IT/security, risk management and internal audit. Ensure knowledge and coverage survive personnel changes.
3. Establish a means to collect and share threat information, monitor attacks (for example through a SOC), and coordinate emergency response (for example through a CSIRT), customer communication, regulatory contact and public statements.
4. Obtain at least annual management reports on the threat landscape, incidents, risk assessments and progress against the plan. Have the risk function challenge controls and internal audit test their effectiveness; fix gaps. Include security requirements when designing new financial products and services.

2. Identify and assess risk (section 2.2)

1. Know what you operate. Maintain current inventories of information systems and external services, hardware and software (including versions and support end dates), and customer or confidential data. Keep data-flow and network diagrams current, including external connections and assets managed by providers.
2. Collect and assess intelligence. Gather threat and vulnerability information from incidents, public bodies, industry-sharing groups and providers. Assess likelihood and the effect of attacks on operations and information assets. Include insider threats and attacks that bypass perimeter defenses. Reassess at least annually, when major threats or vulnerabilities emerge, and when launching new products or services.
3. Choose and authorize treatment. Rank risks and document actions, owners and deadlines: avoid, reduce, accept or transfer the risk. Define exceptions and residual-risk acceptance procedures; obtain management approval for exceptions and acceptance, and report residual risks periodically.
4. Manage vulnerabilities and test plans. Define intelligence sources, impact assessment, patch/remediation deadlines and exception approvals. Use inventories to find affected systems and address severe vulnerabilities promptly, including relevant group companies and critical suppliers. Perform vulnerability assessments, penetration tests and regular incident exercises. Involve senior management and business owners in exercises and feed lessons into improvements.

3. Protect systems, people and data (section 2.3)

• Identity and access: Grant only approved access needed for a job; separate duties. Control the complete account lifecycle, regularly review access and activity, and restrict privileged and supplier access. Set authentication strength by system and data criticality; use multifactor authentication for remote access to important systems. Protect system-to-system authentication and physical access to sensitive facilities.
• Training and customers: Give all staff, including executives, recurring role-specific security training and incident instructions. Check that relevant provider personnel receive appropriate training. Warn customers about threats such as phishing where appropriate.
• Data and backups: Classify data by importance. Apply suitable encryption, access controls, and key/certificate lifecycle management; control removable media, retention and secure disposal. Set backup requirements by criticality, protect and verify backup integrity, and test restoration. Account for ransomware by using tamper-resistant backups and/or copies separated from the internal network across multiple environments.
• Systems and networks: Enable only required services and ports; maintain malware protection; replace unsupported components or apply compensating measures with a migration plan. Segment networks, review firewall rules and allow only necessary traffic. Define procedures for collecting, monitoring, retaining and protecting logs from tampering. Build security into product and system design.
• Cloud: Understand the service’s shared-responsibility model, check exposure and configuration, monitor changes and incident coordination, and plan for secure data handling on exit. Outsourcing or cloud use does not remove the institution’s responsibility to understand the coverage of its controls.

4. Detect attacks (section 2.4)

Define how events are monitored, analyzed and reported. Include cloud services and supplier-managed systems according to each party’s responsibilities. Continuously watch for unauthorized devices or software, suspicious endpoint behavior, patch status, intrusions, unusual network traffic and data transfers, abnormal staff access, and provider maintenance access. Triage alerts by impact and criticality, determine whether they are incidents, escalate promptly, and periodically review alert rules and thresholds. Depending on the service, 24/7 monitoring and SIEM correlation are examples in the FSA’s desirable, rather than universally prescribed basic, items.

5. Respond and recover (section 2.5)

1. Prepare: Write and exercise incident response and contingency/recovery plans for relevant attacks such as DDoS, website tampering, malware/ransomware, exploited vulnerabilities and fraudulent transfers. Set business priorities, recovery targets, decision authority, contact details and communication routes.
2. Triage and investigate: Accept signals from monitoring, customers and outside organizations. Confirm facts, assess business impact and escalate to the incident lead, CISO and management under predefined criteria. Preserve logs and other evidence before analysis. Record decisions and actions from detection through recovery.
3. Communicate and contain: Tell affected customers what happened and what they should do when secondary harm is possible. Report promptly to regulators as required by applicable laws and rules, and publish appropriate verified information when required or needed to protect customers. Predefine who may isolate a network or stop a service; weigh containment against business continuity and evidence preservation.
4. Eradicate and restore: Remove malware and causes of compromise, remediate vulnerabilities, and rebuild affected systems. Check whether backups are infected or altered. Validate system operation, safe reconnection and the functioning of critical business services. The authorized decision maker should confirm that the cause has been addressed before resuming service. Review the incident and improve plans and controls.

6. Manage third parties throughout (section 2.6)

Identify suppliers, cloud providers and connected services; assess each according to its business criticality, data access and connectivity. Assign internal ownership and manage risk before contracting, during delivery and at exit. For important providers, assess their cybersecurity arrangements and incident/recovery plans.

Depending on criticality, make contracts and service-level agreements explicit about responsibilities, audit rights, subcontracting, security controls, serious vulnerability and incident reporting, joint exercises, data location/retention/transfer/deletion, and exit arrangements. Monitor performance and risk continuously; revoke access and dispose of or return data at termination. Considering provider concentration, downstream suppliers, alternative service arrangements and tested exit strategies are among the FSA’s desirable measures.

A practical starting checklist

Area	Evidence and activities to establish
Governance	Board policy, CISO and role assignments, annual review, funded plan, management reports and audit follow-up
Identify	Current inventories and diagrams, critical-service mapping, risk assessments, vulnerability deadlines and approved exceptions
Protect	Access reviews and MFA, patching, logs, encryption/key handling, separated backups and restore tests, staff training
Detect	Defined monitoring scope and provider boundaries, alert rules, triage and escalation, periodic tuning
Respond and recover	Scenario-specific plans, contact lists, exercises, evidence preservation, reporting and restart criteria
Third parties	Tiered due diligence, contracts, ongoing monitoring, data and access controls at termination

Use the checklist as a starting point, then map every applicable item in the original guidance and the relevant sector-specific supervisory guidelines to your institution’s services and risks. Chapter 3 principally describes the FSA’s own collaboration with public authorities and industry bodies, not another checklist of controls for each firm.

Source: Japan Financial Services Agency, Guidelines on Cybersecurity in the Financial Sector (Japanese PDF), published 4 October 2024. Section numbers above refer to the original Japanese document.