Incident Lake
特徴arrow_forward機能arrow_forward導入事例arrow_forwardご利用の流れarrow_forwardナレッジ先進事例インタビューarrow_forward勉強会レポートarrow_forwardお役立ち記事arrow_forwardFAQarrow_forwardお知らせarrow_forwardお問い合わせarrow_forward無料トライアル
Featuresarrow_forwardFunctionsarrow_forwardHow it worksarrow_forwardFAQarrow_forwardNewsarrow_forwardContactarrow_forwardFree trial
Japanese
English

July 22, 2026

[Logistics Operators (Land Freight and Port Transportation)] How the Active Cyber Defense Act Will Change Incident Response

[Logistics Operators (Land Freight and Port Transportation)] How the Active Cyber Defense Act Will Change Incident Response

The public-private collaboration provisions of the so-called Active Cyber Defense Act (official title: Act on the Prevention of Damage Caused by Unauthorized Acts Against Critical Computers), enacted in May 2025, take effect in October 2026. The covered critical infrastructure sectors include motor truck transportation (road freight) and port transport, and designated operators will be legally required to register their system assets and report cyber incidents to the government.

For the logistics industry, this wave of regulatory tightening is not someone else's problem.

Logistics is, in fact, at the center of it. The ransomware attack on a container terminal at the Port of Nagoya in July 2023 was the direct trigger for designating ports as critical infrastructure and adding port transport to the critical infrastructure framework. At the heart of the system's design is a real incident that happened in logistics.

This article takes the Port of Nagoya incident as its starting point and lays out, across three layers (the law, sector-specific business acts, and guidelines), what incident response road freight and port transport operators will be expected to carry out in practice.

Where It All Began: What Happened in the Port of Nagoya System Outage

In July 2023, the Nagoya United Terminal System (NUTS) was brought down by a ransomware attack, halting container pickup and delivery for more than two full days. The shutdown of a port with one of the largest container volumes in Japan rippled far beyond the port itself, with trailers backed up and logistics delayed across the region.

On the ground, some vessel cargo handling continued manually even while the system was down. In the recovery phase, operators verified that the data matched actual inventory and then brought terminals back online one at a time as each was ready.

Getting by manually when the system is down is not impossible, but it falls far short of normal throughput, and a heavy data reconciliation effort is waiting at recovery time. That picture is the starting point for any discussion of incident response in logistics.

The review committee set up in response to the incident issued its summary report in January 2024, setting out three institutional measures: measures under the Basic Act on Cybersecurity (adding ports as a critical infrastructure sector and drawing up guidelines), measures under the Port Transport Business Act (adding security items to business plan reviews), and measures under the Economic Security Promotion Act (adding port transport to the critical infrastructure framework).

Everything that has followed builds on that report.

What the Law Requires: Registration and Incident Reporting

The Act applies directly to designated critical infrastructure operators (specified essential infrastructure operators) designated under the Economic Security Promotion Act. As of April 1, 2026, a total of 257 operators across all sectors had been designated.

Designation in the logistics sector is relatively recent. For port transportation, the framework took effect in April 2025 following a legislative amendment enacted in May 2024, and operators were designated on May 1, 2025. After a transitional period, prior notification and screening for outsourced implementation and maintenance of terminal operating systems (TOS) began on November 2, 2025.

In land freight transportation, operators were designated on July 14, 2025, following an amendment to the ministerial ordinance that defines the scope of covered equipment.

The Act imposes two obligations on designated operators. First, they must notify the government of vendor names, product details, and other information for any information systems supporting core operations that qualify as “specified critical computers.” Second, they must report incidents when they are hit by a cyberattack.

As for the reporting framework, the draft implementation approach presented to the Cabinet Office’s expert panel calls for two stages: a “preliminary report” issued promptly once an incident is recognized, followed by a “detailed report” within 30 days. In both cases, operators need only report what they know at that point; a complete root-cause analysis is not expected in the initial response. Reporting covers not only traces of “specified unlawful acts” such as unauthorized access, but also events that could lead to them. By design, the reporting obligation kicks in at the warning-sign stage.

Cloud usage has also been addressed. For SaaS, and for PaaS covering middleware or operating systems, an incident is deemed “recognized” the moment the cloud provider issues a notification. Operators running dispatch, fleet management, warehouse management (WMS), or transportation management (TMS) systems in the cloud therefore need to decide in advance who receives outage and breach notifications from vendors, and how those notifications feed into the reporting workflow.

The penalties are not trivial either. Failing to comply with a corrective order from the supervising authority after breaching the registration obligation carries a fine of up to 2 million yen, and failing to respond to a request for documents or other materials carries a fine of up to 300,000 yen.

One point the logistics industry should pay particular attention to is the knock-on effect on operators that are not designated. It has been noted that IT vendors and group companies contracted to operate specified critical computers, and depending on the system architecture even equipment owned by subcontractors, may fall within scope.

In a sector where multi-tiered prime-contractor and subcontractor structures are the norm and system and data integration between companies keeps advancing, it is entirely plausible that a company could be drawn into the framework as a “contractor or connected party of a designated operator,” even without being designated itself.

In port transportation, screening has “already” begun

Even before the Act takes effect, a binding mechanism is already in place in port transportation. Under the amended Enforcement Regulations of the Port Transportation Business Act (effective March 31, 2024), business plans submitted for screening when entering the general port transportation business, among other occasions, must now include an overview of the TOS and the measures taken to ensure information security. In effect, the national government verifies the state of TOS security through its review of business plans.

Unlike the guidelines, which are recommended standards, this is a mandatory requirement, an item in the business plan application itself. In port transportation, security measures have already moved from “something worth doing” to “a condition of doing business.”

Incident Response in Practice, as the Guidelines Describe It

The Ministry of Land, Infrastructure, Transport and Tourism (MLIT) has issued three safety guidelines for the logistics sector, covering trucking, warehousing, and vessel operations (all first editions, April 2024), and the “Safety Guidelines for Ensuring Information Security in the Port Sector” for ports. The port guidelines have been revised repeatedly since the first edition in April 2024, with the third edition published in May 2026. A first edition released just nine months after the Port of Nagoya incident, revised every year since, is a fair measure of how urgently the government views this sector.

These guidelines are recommended standards with no government audit behind them, but they lay out the practical groundwork for meeting the reporting obligations under the Act. Here are the points worth noting from an incident response perspective.

  • Building a structure that involves senior managementThe port sector guidelines start from the premise that increasingly complex and sophisticated cyberattacks cannot all be prevented. They call for an organization-wide response that includes senior management, and for stronger incident response built on a combination of proactive risk management and crisis management. The starting point is that this is not something frontline system staff can handle on their own.
  • Communication and record-keeping when an incident occursThe port sector guidelines set out concrete actions: when attacked, contact MLIT and the police, and keep a running chronological record of the situation. That timeline becomes the foundational material for both the subsequent root-cause investigation and the preliminary and detailed reports under the Act. The key is to build, during normal operations, a process in which recording starts the moment an anomaly is noticed.
  • Preparing for ransomwareThe guidelines state explicitly that when a ransomware attack comes with a ransom demand, it is advisable to strictly refrain from paying, not least to avoid encouraging further attacks. They also require that backups be taken properly and stored separately from production systems. The Port of Nagoya was able to recover only because its data could ultimately be restored; how you back up can decide the outcome of an incident response.
  • Designing recovery procedures in advanceAs the Port of Nagoya timeline shows, recovery does not end when the system is brought back up. The recovery phase brings its own tasks: reconciling work processed manually during the outage with the data in the system, and deciding on a phased restart for each terminal and site. If your operations switch to manual processing during a system outage, it is well worth identifying in advance exactly what will need to be reconciled against what.

What to Do Before the Law Takes Effect

With enforcement coming in October 2026, the to-do list for designated (or likely-to-be-designated) operators is coming into focus.

  1. Asset inventoryIdentify the specified critical computers and peripheral equipment that may be subject to notification. For port transportation the focus is the TOS; for land freight it is dispatch and fleet management systems; for warehousing it is the WMS. Work backward from the scale of the impact to pinpoint which systems would bring operations to a halt.
  2. Establishing a reporting workflowBuild into your emergency response plan the definition of “recognition” (including notifications from cloud vendors), who drafts the preliminary report and who approves it, and the investigation setup for delivering the detailed report within 30 days. If the MLIT and police contacts and chronological records required by the guidelines are designed separately from the statutory reports under the Act, the front line will be left confused. Consolidate them so that “once something is recorded, it can be reused for every report.”
  3. Mapping out business partnersFor the contractors that run your systems and the shippers, prime contractors, and subcontractors you exchange data with, confirm who contacts whom, and when, in the event of an incident. As the Port of Nagoya incident showed, a logistics incident never stops at a single company. Planning for both scenarios, being the source of an incident and being caught up in a failure at a connected party, is the kind of preparation this industry in particular requires.

Some details of the law will still be fleshed out in cabinet and ministerial orders and operational rules before it takes effect, so items marked “draft” in this article may change. For the latest information, please refer to materials published by the Cabinet Office (cybersecurity and economic security divisions) and MLIT.

That's Where Incident Lake Comes In

Incident Lake

As we have seen, the real burden of complying with the Act lies less in setting rules during normal operations than in the practical work that begins the moment an incident occurs. Sorting out the known facts and issuing a preliminary report promptly, keeping a chronological record while the response is under way, compiling a detailed report within 30 days, and handling reports to multiple recipients including MLIT, the police, and business partners. And as the Port of Nagoya incident showed, logistics incidents have a wide blast radius, leaving a team in the middle of a response with almost no capacity for reporting.

Incident Lake is an incident management platform built to support this entire flow. It automates everything from the initial report through recovery, including creating and managing reports, so that your people can spend their time on what matters most: stopping the outage in front of them and keeping freight moving. With deadline-bound reporting such as preliminary and detailed reports now becoming a legal requirement, this is the moment to move reporting and record-keeping away from reliance on individual effort.

References

arrow_backBack to articles

Try Incident Lake with a free trial

We'll issue your trial account within 3 business days of your request, often the same day.
Have questions about getting started? Feel free to reach out.

rocket_launchStart a free trialmail_outlineTalk to us