About the author: Tomoko Kamisago, Public Relations
Hello, I'm Tomoko Kamisago, and I work in public relations at a SaaS company. I'll be writing this series.
Let me be upfront: I'm not a crisis communications veteran who has battled through one firestorm after another. I've never actually stood at the podium of a press conference. What I have done, at a previous company, is build a crisis communications manual in earnest together with a consultant, put internal policies in place, and plan and run drills based on simulated crises. In this series, I look back on that experience and write about what was hard, and how I wish we had organized things. I hope you'll read it not as a collection of war stories, but as the record of someone who sat down and properly built a preparedness program once.
To ground us in what's happening in society right now, Part 1 starts with a change in the law.
What the Active Cyber Defense Act, taking effect in October, signals
On October 1, 2026, the Act on the Prevention of Damage Caused by Unauthorized Acts Against Critical Computers, commonly known as Japan's Active Cyber Defense Act (the Act on Strengthening Cyber Response Capabilities), takes effect.
Many of you are probably thinking, "That sounds like a complicated law," so I'll break it down as simply as I can.
Put simply, what this law sets out to do is establish a rule: "Companies that support the foundations of everyday life, such as electricity, gas, telecommunications, water, finance, and aviation (legally referred to as 'critical infrastructure operators'), must properly report to the government when they suffer a cyberattack." It is said to cover 15 sectors and roughly 257 companies*1.
*1 National Cybersecurity Office, Cabinet Secretariat, "On the Act on Strengthening Cyber Response Capabilities and the Related Development Act"
https://www.cas.go.jp/jp/seisaku/cyber_anzen_hosyo_torikumi/index.html
https://www.cas.go.jp/jp/seisaku/cyber_anzen_hosyo_torikumi/pdf/setsumei.pdf
Think of it this way: companies that underpin society now have a new rule that says, "If the 'fire' of a cyberattack breaks out, report it to the government following the prescribed procedure." If a company fails to report, the supervising ministry can issue a corrective order, and continued noncompliance can result in fines*2.
*2 Act on the Prevention of Damage Caused by Unauthorized Acts Against Critical Computers (Act No. 42 of 2025)
https://laws.e-gov.go.jp/law/507AC0000000042
The important point here is how risky it is to think, "We're not a critical infrastructure operator, so this doesn't apply to us." Even if you're not directly covered by the law, plenty of companies provide systems or services to covered companies, or are connected to them as business partners or contractors. When those supporting critical infrastructure start moving, the companies around them will eventually be expected to meet the same level of preparedness. Rather than "We're not covered, so we're fine," I think it's closer to reality to see it as "The companies that are covered are starting to change."
I'm a little embarrassed to admit that when I first saw the news about this law, I thought it didn't have much to do with me. But as I dug deeper, I realized this isn't just about specific industries. It's a sign that society as a whole is moving toward expecting companies to be prepared. That realization is where this series begins.
Why crisis communications never rises up the priority list
Even when the law changes, crisis communications rarely moves up the priority list at most companies. I think this is a wall every PR professional runs into at some point.
What I want to avoid here is reducing it to the simple story that "leadership doesn't understand crisis management." If you put yourself in leadership's shoes, there are real reasons the investment decision is hard.
First, a company has to generate revenue today, next month, and next quarter with limited resources. In that context, investing in something that may or may not happen is very hard to evaluate compared with other investments. If you build a new feature, you can judge it by the revenue it brings in. But the only way to prove that an investment in crisis communications is working is that "nothing happened." It's a slightly cruel structure: the better it works, the less visible the results become.
On top of that, internal evaluation systems are often designed to reward "offense," and mechanisms that encourage investment in "defense" tend to be weak. I see this less as a problem with leadership alone and more as a structural challenge common to many companies.
That's exactly why I don't think a company needs to aim for perfection in crisis management while it's still small. As a rule of thumb, the realistic approach is to start chipping away at it once the business has stabilized, the number of customers and employees has grown, and you have more to lose. If your company is already working on a BCP (business continuity plan), the most natural way to start is by adding a crisis communications perspective to it. You could say crisis communications owns the part of the BCP that answers, "How do we explain this to the outside world?"
Turn external pressure into an ally
Having read this far, some of you may be wondering, "So how do I explain this to leadership in a way that gets them to act?"
What I can say from my own experience is that rather than trying to move leadership through internal persuasion alone, it's far faster to make external pressure work in your favor. Legal changes like the one discussed here, of course, but also due diligence from investors, audits from business partners, and industry association guidelines: the fact that "this is being required of us from the outside" is more persuasive than building an argument from scratch internally.
I chose this legal change as the entry point for Part 1 precisely because I want you to use this "external pressure" as your first step.
Where this series stands
Finally, let me restate the stance of this series.
I'm not an expert who has moved from one major system outage or press conference to the next. I'm a single practitioner who, at a previous job, built a crisis communications manual in earnest with the help of a consultant and went as far as actually running drills. What I share from here on is written looking back from the perspective of "If I were to build it again from scratch."
Next time, I'll talk about the big picture, to help you get out of the "I don't even know where to start" stage of crisis communications.
About the author
Tomoko Kamisago, Public Relations
Has worked in public relations for about 14 years. Shifted her focus from the culture and entertainment industry to B2B SaaS nearly 8 years ago. She has a continuing interest in how the global economy, premised on ESG management, is building non-financial capital into management strategy as a "source" of medium- to long-term corporate value and competitiveness. The value she holds most dear is integrity. Her life's work is doing PR for the PR profession itself, to help Japan become a "PR-advanced nation."