JFSA — Cybersecurity Guidance for Financial Institutions

Why does it matter?

The Guidelines turn cybersecurity into a management duty. Section 1.2.2 states that cybersecurity is not only an IT matter and that directors may be held liable for breach of the duty of care under the Civil Code, the Companies Act and financial laws if weak cybersecurity damages the institution or third parties. Section 1.2.1 warns against a risk approach that only formally complies with the Guidelines and expects substantive action. Banks, life and non-life insurers, securities firms and payment service providers are also designated critical infrastructure operators under the Basic Act on Cybersecurity, so the same controls support both obligations.

Key benefits include:

• Executive accountability

Section 2.1.1 requires the board and senior management to set a basic cybersecurity policy, review the framework at least once a year, appoint a person such as a CISO to oversee cybersecurity, and receive a report at least once a year.

• Two tiers of expectation

Every item is either a fundamental response measure or a recommended measure, so a regional bank and a major bank can see which expectations apply to each.

• A defined supervisory scope

Section 1.4 lists the institutions covered, from major and regional banks to crypto-asset exchange service providers, prepaid payment instrument issuers and financial instruments exchanges.

• Coverage of the whole group

Section 1.2.1 expects a consistent cybersecurity framework across a group, including overseas locations, adjusted for the scale of each subsidiary.

• Supply chain in scope

Section 2.6 extends expectations to third and fourth parties, including cloud service providers and concentration risk.

How does it work?

The Guidelines follow the lifecycle of a cyber event. Section 2.1 covers governance: basic policy, regulations, resources and people, oversight by the risk management department (2.1.4) and internal audit (2.1.5). Section 2.2 covers identification: information assets, the risk management process, vulnerability management, vulnerability assessment and penetration testing, and exercises. Sections 2.3 and 2.4 cover defense and detection, and section 2.5 covers response and recovery.

Each subsection pairs the two measure tiers. For example, 2.2.4 asks every institution to run regular vulnerability assessments and penetration tests, and recommends regular threat-led penetration testing (TLPT) with a Blue Team evaluation. Section 2.3.1(5) requires multi-factor authentication for remote access to critical systems, and 2.5.1(1) requires incident response and contingency plans per type of cyberattack with recovery time objectives. The FSA publishes the Japanese text with a provisional English translation, and section 1.2.1 tells institutions to refer to related guidelines such as the FISC Security Guidelines on Computer Systems for Financial Institutions.

Key Elements

• Basic policy and annual review (2.1.1)

The board formalizes cybersecurity as part of organization-wide risk management, reviews the framework at least once a year, and receives annual reports on risk status, assessment results and plan progress.

• Three lines of defense (2.1.1 to 2.1.5)

Recommended measure (a) clarifies roles across business units, risk management and internal audit; the risk management department oversees independently of the business.

• Information asset ledgers (2.2.1)

Hardware, software and data are inventoried with support periods and versions; a software bill of materials is a recommended measure for in-house software.

• Risk assessment at least annually (2.2.2.2)

Likelihood and impact are assessed from threat and vulnerability information, and again on significant threats or new products.

• Defense in depth (2.3)

Perimeter, internal network and data-leak controls are combined, with least privilege, privileged account controls, logging and tamper-resistant, isolated backups (2.3.3(5)).

• Response and recovery (2.5)

Initial response, analysis, customer and public communication, containment, eradication and recovery are defined stages, with prompt reporting to authorities as laws require (2.5.2.3(3)).

What does it cover?

The Guidelines apply to all financial institutions and related entities that are subject to the FSA's Comprehensive Guidelines for Supervision and administrative guidelines (section 1.4). The listed types include major banks, regional and small and medium-sized financial institutions, insurance companies, financial instruments business operators, credit rating agencies, money lending business operators, prepaid payment instrument issuers, funds transfer service providers, crypto-asset exchange service providers, electronic payment service providers, agricultural and fishery cooperative financial institutions, financial market infrastructures and financial instruments exchanges. Definitions follow the Comprehensive Guidelines for each business type.

What are its objectives?

The Guidelines exist to carry out the FSA's duty under Article 3 of the Act for Establishment of the Financial Services Agency to ensure the stability of financial functions and protect depositors, by raising cybersecurity across the sector.

Make cybersecurity an executive and board responsibility, not only an IT task.

Set a risk-based baseline of fundamental measures that every institution meets, and recommended measures for institutions whose failure would affect the wider economy.

Cover the full cycle of governance, identification, defense, detection, response and recovery.

Bring third-party and supply chain risk, including cloud services and fourth parties, inside the institution's cybersecurity framework.

Support sector cooperation through Financials ISAC Japan, FISC and the FSA's links with the National Cybersecurity Office (section 3).

Framework in Context

The Guidelines add detail to the FSA's earlier Policy Approaches (2015, updated 2019) and stand beside the Comprehensive Guidelines for Supervision, whose system risk management provisions the FSA amended on the same day. Section 1.2.1 names related material: the Cybersecurity Policy for Critical Infrastructure Protection, the FISC Security Guidelines on Computer Systems for Financial Institutions, the NIST Cybersecurity Framework and the Cyber Risk Institute Profile. The text also points to the FSA Discussion Paper on Ensuring Operational Resilience (April 2023) for risk appetite and tolerance.

Common Framework Mappings

Institutions map the Guidelines to the frameworks below so that one control set and one body of evidence serves the FSA, group supervisors and auditors.

Mapped frameworks include:

CIS Controls v8.1

EU DORA

ISO 27001:2022

MITRE ATT&CK

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2

SWIFT CSCF