We control information and cyber security across the Group to ensure the appropriate and safe management of business information and systems as we develop into a leading provider of solutions for global social issues.

The threat of cyber-attacks has been mounting with the rapid advancement of IoT and digital transformation. Attacks can result in the leakage of personal or confidential information assets and endanger business continuity. In keeping with the TOPPAN Group Basic Policy on Information Security and the Personal Information Protection Policy, we apply secure technologies and rigorous control in operations throughout the Group to reciprocate the trust of customers and society and drive a digital transformation that enhances our corporate value. We introduce systems and tools to counter cyber-attacks and reinforce safeguards in the secured areas designated for the handling of personal information throughout Japan.

Setting up Tightly Secured Areas

Controlling the Tightly Secured Areas

TOPPAN constantly upgrades security levels for the handling of personal and confidential information through regular internal audits and day-to-day operational checks based on the rules for managing the tightly secured areas within the Group. The key security management measures are described below.

Operational management inspection through internal audits:
Dedicated auditors regularly inspect the installation, management, and operation of tightly secured areas. Managers assess and accredit inspection results to maintain and further enhance operational management across the Group.

Access control:
Each tightly secured area is protected with technical safeguards to prevent unauthorized persons from entering (e.g., personal authentication measures, controls to inhibit the entry of two or more persons at the same time). Lockers and secure storage compartments for personal belongings are provided outside of the areas, as persons entering are not allowed to bring in cameras, cell phones, smartphones, or other devices that record or communicate images, videos, audio, or any other form of data.

Area control:
Surveillance cameras eliminate blind spots in the tightly secured areas and monitor any unauthorized removal or transport of data.

Controlling Security across the Supply Chain

Some of our operations that involve the handling of personal and confidential information are entrusted to Group and partner companies. TOPPAN also relies on the cloud services of external companies in the execution of some of the Group’s business operations.

We mitigate supply chain risks by checking the safety of cloud services and deploying a system to certify business partners who take appropriate security measures. The control levels required of business partners to satisfy the security standards under our certification system depend on the types of information and operations entrusted to them.

Managing Information Assets in Internal Operations

Information assets handled in internal operations are classified by confidentiality. Our rules governing storage, removal, disclosure, etc. ensure the safe handling of information assets in line with their classifications.

Cyber-attacks pose especially significant security risks to the Group. TOPPAN has been implementing various measures to mitigate them.

Protecting PCs and Servers with EDR App

In fiscal 2019 we began installing the Endpoint Detection and Response (EDR) app to detect suspicious software behaviors in PCs and servers. EDR is now installed in PCs used for administrative work, terminals used onsite in production settings, and on Apple computers and network servers running across the Group. The combined use of EDR with network logs further solidifies our information security system to ensure prompt detection and defensive actions against sophisticated malware.

Mitigating Cloud Security Risks with CSPM Service

As mega cloud services expand, we have been using a Cloud Security Posture Management (CSPM) solution to mitigate security risks in public cloud environments. The CSPM tools identify risks associated with inappropriate exposure and other settings specific to cloud configurations and promptly detect and correct any settings subject to unduly high risk.

Implementing Threat Intelligence and ASM* Service

TOPPAN continues to implement threat intelligence, third-party evaluations, and open source intelligence (OSINT) activities to detect signs of cyber-attacks against the Group and vulnerabilities visible to outside parties early on. We strive to mitigate cyber-attack risks by addressing weaknesses within the Group preemptively. We are also enhancing cyber security throughout the supply chain. Business partners entrusted with operations involving the handling of personal and confidential information have been subject to our vulnerability-detection measures since fiscal 2022.

*Attack surface management

Upgrading Website Vulnerability Assessments

Weaknesses in our web applications have been assessed to counter cyber-attacks targeting website vulnerabilities. An automatic vulnerability detection system periodically checks the network and addresses vulnerabilities that arise from day to day. This system works synergistically with various external vulnerability-detection services to further reinforce our web-based services and our ability to provide clients with more tightly secured services. Security guidelines on coding have also been formulated for our website creators. Guideline compliance training is provided to encourage the creators to develop webpages less likely to contain vulnerabilities from the design stage.

Setting Guidelines for Cyber Emergencies

Cyber threats have been escalating across borders. Their malice and unprecedented technical cunning can result in instant and severe damage in all directions. The conventional methods used against cyber-attacks are often useless. TOPPAN formulates guidelines that summarize basic approaches, preparations, and action flows to address serious information security incidents caused by cyber-attacks and other destructive acts. We are constantly strengthening our responsiveness to cyber emergencies on the assumption that unforeseen incidents can always happen.

Blocking Unauthorized Connections

New safeguards are in place to mitigate the risks of virus infections and information leakages stemming from connections by unauthorized devices brought into workplaces. Our internal LAN is now equipped with network sensors. A system is also in place to check the consistency between actual in-house network communications and the IT asset information managed in our database.

Countering Email Attacks

Cyber-criminals exploit the botnet Emotet, business email compromise (BEC), and other malicious email techniques used to send fraudulent messages. As a countermeasure adopted in fiscal 2022, TOPPAN introduced an advanced service that screens incoming emails with help from AI analysis and machine learning algorithms. This service blocks a high percentage of targeted email attempts to steal money, exploit information, or compromise networks in other ways. By providing this screening service to more Group companies from fiscal 2023 onward, we continue to fortify our email systems against cyber-attacks.

Enhancing the Capabilities of TOPPAN-CERT

TOPPAN-CERT is a cyber response team made up of specialists from across the Group. In December 2023 the team participated in a series of collaborative cross-sector drills organized by the Nippon CSIRT Association (NCA) and the National center of Incident readiness and Strategy for Cybersecurity (NISC) of Japan. The CERT members took the lead in responding to simulated cyber-attacks targeting the TOPPAN Group. Response procedures have been reviewed to pinpoint weaknesses in our cyber-counter capabilities and clarify improvement points in the handling of a cyber-attack. In February 2024 we established an immediate response framework to defend against cyber incidents occurring in Group companies anywhere in the world.

Sharing Information on Cyber Security Preparedness

TOPPAN holds quarterly cyber-security information-sharing sessions for personnel involved in information security management to heighten the understanding of cyber security preparedness within and outside of the Group.

Tightening Plant Security

Cyber-attacks continue to increase with the shift to smart factories made up of multiple network-connected components. TOPPAN is enhancing the security of facilities and equipment by familiarizing production engineers with the plant security guidelines issued in June 2023.

TOPPAN Group companies in Japan have acquired ISO/IEC 27001 certification for information security management systems (ISMS), PrivacyMark accreditations under Japanese Industrial Standards (JIS) Q 15001:2017 for personal information protection management systems, and other third-party certifications, as shown in the following tables (as of June 30, 2024).