[Water Utilities] How the Active Cyber Defense Act Changes Incident Response

The public-private collaboration provisions of the so-called Active Cyber Defense Act (explainer), formally the Act on the Prevention of Damage Caused by Unauthorized Acts Against Critical Computers, enacted in May 2025, take effect in October 2026. Water supply is among the covered sectors alongside electricity, gas, and telecommunications, and designated water utilities will be legally obligated to register their system assets and report cyber incidents to the government.

"We're on a closed network, so it doesn't apply to us" and "our monitoring and control systems have always been isolated" are things you often hear on the front lines of critical industries. But reading this law together with the Safety Guidelines for Ensuring Information Security in the Water Supply Sector, issued by the Ministry of Land, Infrastructure, Transport and Tourism in March 2025, makes clear that those assumptions themselves are due for a rethink. In this article, we lay out what incident response water utilities will be expected to carry out in practice, organized under three headings: the law, the ministerial ordinance, and the guidelines.

What the Law Requires: Registration and Incident Reporting

The Act directly covers operators in the 15 critical infrastructure sectors defined under the Economic Security Promotion Act; as of July 2025, a total of 257 operators had been designated. Water supply is one of those 15 sectors. Designated operators must register with the government the vendor names, product information, and other details of any information systems supporting core operations that qualify as "specified critical computers," and must report incidents when they are hit by a cyberattack.

As for what the reports must contain, the draft approach to implementation presented to the Cabinet Office's expert panel sets out the following framework.

First, reporting happens in two stages: a preliminary report submitted promptly upon becoming aware of an incident, and a detailed report submitted within 30 days. In both cases, operators only need to report what they know at that point; a perfect root-cause analysis is not expected during initial response. The scope of reporting covers not only evidence of "specified unauthorized acts" such as unauthorized access, but also events that could lead to them. In other words, the obligation is designed to kick in at the warning-sign stage, not only once an intrusion has been confirmed.

The draft also addresses cloud usage. For SaaS and for PaaS (covering middleware and operating systems), an operator is deemed to have become "aware" at the point the cloud provider sends a notification. Utilities that have moved meter reading, billing, or ledger systems to the cloud need to decide in advance who receives outage and breach notifications from vendors, and how those notifications feed into the reporting flow.

The penalties are not trivial either. Failing to comply with a corrective order from the supervising authority after breaching the registration obligation carries a fine of up to 2 million yen, and failing to respond to a request for documents or other materials carries a fine of up to 300,000 yen.

Although only large operators are directly designated, undesignated organizations are not off the hook. It has been pointed out that IT vendors and group companies contracted to operate specified critical computers, and depending on the system configuration even equipment owned by contractors, may fall within scope. In the water supply sector, where joint operation, regional consolidation, and comprehensive outsourcing are advancing, organizations should keep in mind that they could be drawn in as a "contractor."

What the Ministerial Ordinance Already Requires

It is easy to overlook, but mandatory cybersecurity standards already exist in the water supply sector. Article 1, Item 11-2 of the Ministerial Ordinance Establishing Technical Standards for Water Supply Facilities requires that necessary measures be taken to ensure the cybersecurity of computers used to manage facility operations, so that there is no risk of serious disruption to the water supply. This provision was introduced in a 2019 amendment to the ordinance and has been in effect since April 2020.

What specifically needs to be done is set out in the "Points to Note" issued by division director notice, which was revised in February 2025 to coincide with the first edition of the Safety Guidelines. It lists measures such as user authentication for computers in control systems and installing antivirus software and keeping it up to date. The accurate picture today is that operators with monitoring and control systems are already under a legal obligation to act, without waiting for the Act to take effect.

Incident Response in Practice, as the Guidelines Describe It

The MLIT Safety Guidelines (first edition, March 2025) are recommendations rather than mandatory requirements, but it is fair to say that nearly all of the practical groundwork for meeting reporting obligations under the Act is written there. Picking out the elements that relate to incident response, the flow looks roughly like this.

Peacetime: build the structure and the plan. The guidelines call for setting up a CSIRT or similar body to handle incidents when they occur, and for agreeing in advance on the division of roles with related departments. The CSIRT can be either permanent or stood up only when an incident occurs, so even small and mid-sized utilities that struggle to secure dedicated staff can design one. The guidelines also call for a contingency plan that defines initial response after a critical infrastructure service outage (or the risk of one) is recognized, along with a BCP and IT-BCP. To meet the Act's requirement of a prompt preliminary report upon awareness, it is effectively a prerequisite to write into that initial response plan the concrete path by which information travels from the moment on-site staff notice an anomaly to management and the reporting contact.

Detection: act from the warning-sign stage
The guidelines address responding to the "warning signs" of a cyberattack in the crisis management chapter, which is consistent with the Act's reporting scope extending to "events that could lead to specified unauthorized acts." An operation that waits and watches until a breach is confirmed will not meet the standard the law demands.

Response and recovery: factor in the limits of manual operation
One strength of water utilities is that, even if monitoring and control systems go down, manual fallback operation is possible to some degree. But as the guidelines themselves point out, efficiency drops during fallback operation and disruption to water service is to be expected. Rather than assuming "worst case, we can run it by hand," the contingency plan should spell out the criteria for switching to manual operation, the procedures, and the staffing arrangements.

Information sharing: make use of CEPTOAR
The water supply sector has CEPTOAR as a framework for sharing incident information and attack warning signs, with the Japan Water Works Association serving as its secretariat. Once the Act takes effect, two channels will run in parallel: statutory reporting to the government and information sharing within the industry. Working out in advance which information goes where, and on whose decision, will reduce confusion.

Image source: Ministry of Health, Labour and Welfare, Survey on Cybersecurity Measures in the Water Supply Sector, p. 37

Training: make the plan something that actually works. The guidelines list exercises and drills as a standalone item. Even a single tabletop exercise will reveal gaps in reporting templates and contact lists. Practicing actually drafting a preliminary report is a highly cost-effective way to prepare before the Act takes effect.

Why "It's Safe Because It's a Closed Network" No Longer Holds

The guidelines devote considerable space to warning against overreliance on closed networks. By their definition, a configuration that merely restricts traffic with firewalls or routers, or one that can be reached over an internet VPN (SSL-VPN or IPsec-VPN), does not count as a closed network. Even a closed network built on dedicated lines loses its physical isolation the moment any single point on a connected network touches the internet.

The guidelines also cite real-world cases. In 2010, at a nuclear fuel facility in Iran, a control system physically disconnected from the internet was infected with malware brought in on a USB drive, shutting down its centrifuges. In 2015, at a Ukrainian power utility, a control system logically separated by firewalls and a VPN was manipulated over that VPN using legitimate credentials stolen from an office workstation, resulting in a large-scale blackout. For water utilities, the connection points between business and control systems, and field sensors and tablets that use internet protocols, can become entry points of exactly the same kind.

From an incident response standpoint, this matters because if a risk assessment dismisses a risk "because the network is closed," neither a detection mechanism nor a reporting trigger ever gets designed. The reporting obligations under the Act begin with "awareness." Without a means of becoming aware, there is no way to fulfill them.

What to Do Before the Law Takes Effect

With enforcement coming in October 2026, the to-do list for designated (or likely-to-be-designated) operators is coming into focus.

First, take inventory of your assets. This means identifying the specified critical computers and peripheral equipment that may be subject to notification, and many covered operators have already begun. The scope covers not only control systems such as supervisory control, pump station operation, and water distribution management, but also peripheral equipment whose compromise could shut down facilities or degrade their function.

Second, build out your reporting flow. Write the definition of "awareness" (including cloud notifications), who drafts the initial report and who approves it, and the investigation structure for delivering the detailed report within 30 days into your contingency plan. This is also the time to reconcile overlaps with existing reporting regimes, such as breach reporting under the Act on the Protection of Personal Information.

Third, involve senior management. The guidelines state explicitly that if an organization suffers damage because of deficiencies in its cybersecurity framework, the executives who took part in deciding that framework may be held liable for damages. Before the law takes effect, your organization should confirm its position: incident response is not an IT department job but a matter of enterprise risk management in its own right.

Some details of the law will be finalized through cabinet and ministerial ordinances and operating rules before it takes effect, so items marked as "proposed" in this article may change. For the latest information, refer to the materials published by the Cabinet Office (Cyber Security Affairs) and the Water Supply Division of the Ministry of Land, Infrastructure, Transport and Tourism.

That's Where Incident Lake Comes In

As we have seen, the real burden of complying with the Act lies less in writing rules during peacetime than in the practical work that starts the moment an incident occurs. Organizing the facts as you learn them and issuing an initial report promptly, logging progress while the response is still under way, compiling a detailed report within 30 days, and then holding a post-incident review to prevent recurrence and inform training: frankly, running all of that by hand with limited staff is not realistic.

Incident Lake is an incident management platform that supports this entire flow. It automates everything from initial reporting through recovery, as well as creating and managing reports, so responders can spend their time on what they should be focused on: stopping the outage in front of them. Now that deadline-driven initial and detailed reports are becoming a legal requirement, we recommend moving your reporting and record-keeping to a system that does not depend on individual heroics.

References

• Ministry of Land, Infrastructure, Transport and Tourism, "Safety Guidelines for Ensuring Information Security in the Water Supply Sector, First Edition" (established March 5, 2025) https://www.mlit.go.jp/mizukokudo/watersupply/content/001889644.pdf
• Cabinet Office, Director-General for Policy Planning (Cyber Security): "Draft Approach Toward Implementation of the Active Cyber Defense Act (Public-Private Partnership)" (December 2025) https://www.cao.go.jp/cybersecurity/kaigi/pdf/04shiryo05.pdf
• Nikkei xTECH: "Active Cyber Defense Act Takes Effect in October; Risk of Exclusion by Business Partners" (2026) https://xtech.nikkei.com/atcl/nxt/column/18/00989/042300207/
• Article 1, Item 11-2 of the Ministerial Ordinance on Technical Standards for Water Supply Facilities (Ministry of Health and Welfare Ordinance No. 15 of 2000)https://www.mhlw.go.jp/web/t_doc?dataId=79aa0299&dataType=0&pageNo=1
• Survey on Cybersecurity Measures in the Water Supply Sectorhttps://www.mlit.go.jp/common/830005151.pdf