The OKI Group is building a robust IT infrastructure to support its business growth. As part of this effort, we are working to strengthen information security from the perspective of minimizing management risks. As our Risk Management Committee has defined "electronic information leakage" and "cyber attack" as common risks, we have made it clear that measures for information security are an important part of management and we are proceeding with them.
Based on the OKI Group Security Basic Policy, the OKI Group has established a system to ensure information security and works to properly manage and protect company and customer information. OKI's Information Planning Division reviews all activities related to information security, and each business unit or group company has a information security promotion team that is responsible for addressing the measures decided by OKI's Information Planning Division.
We have also established relevant rules and regulations for information security. We have examined customer information and data to be processed within the group, defined the types of information to be treated as confidential, and formulated regulations, administrative instructions and guidelines related to the processes of acquiring, generating and discarding such information.
In the OKI Group we use the three perspectives shown in the diagram below to broadly promote information security measures for computers, networks and information systems.
As part of its systems for information protection, the OKI group offers information security education to all employees who use the information infrastructures belonging to the group. Each and every individual is asked to thoroughly protect information assets received from customers as well as highly confidential information assets belonging to OKI. For this reason, we widely communicate basic regulations and rules, and company standards regarding the use of our information networks, desktop computers and mobile computers through group training sessions and e-learning programs.
In fiscal 2019, information security training was provided to all employees by e-learning in August. Closely related to this is personal information protection, for which we also provided training at the same time, and almost 100% of employees received this training.
Aiming at an improved information security level across the supply chain, we at OKI continuously verify how information security measures are implemented at suppliers to whom we provide critical confidential information. Here, we ask our suppliers to carry out self-evaluations and to score themselves based on check lists prepared by us. In this way, suppliers and OKI are sharing issues and remedying any problem points found.
We have established an organization specializing in security incident response called OKI-CSIRT(*1), which collaborates with external organizations, such as the Nippon CSIRT Association, CSIRT in other companies and ministries/agencies, in order to enhance our preventive measures against threats to computer security in the group and improve our capacity to respond to them.
In fiscal year 2019, in line with the revisions to the Cybersecurity Management Guidelines, points relating to recovery from a cyber attack were included in the incident response manual and security inspections on contractors were carried out.
In fiscal year 2019, we conducted training in accordance with the incident response manual and worked to strengthen our ability to respond to cyber attacks.
Computer Security Incident Response Team
The OKI Group has promoted information security measures at overseas sites, including such actions as laying down information security guidelines in each country and region, appointing security managers at each site, and adopting control tools.
In fiscal year 2019, we conducted targeted mail attack measure training that simulated phishing scams, which have increased in recent years. This training was carried out not only in Japan, but also at our bases in Europe and America, China, and Asia.
Overseas, in order to further strengthen IT governance, we are developing communication systems and rules, deploying countermeasure tools, and improving the monitoring environment.
The OKI Group has acquired the ISMS(*2) certification for divisions involved in building and operating internal information systems, and for divisions engaged in general system design development, in order to improve the reliability of network solution construction and related services. In fiscal year 2019, we strengthened our information security system by acquiring ISMS certification for 15 new divisions in Japan.
Information Security Management System
Reports on misuse of public research funds and misconduct related to research
activities can also be filed from the page that opens when you click the above button.