[Electricity and Gas Utilities] How Incident Response Will Change Under Japan's Active Cyber Defense Act

About the author: Takaaki Kanetsuki, President and CEO

The public-private partnership provisions of Japan's so-called "Active Cyber Defense Act" (formally, the Act on the Prevention of Damage Caused by Unauthorized Acts Against Critical Computers), enacted in May 2025, take effect in October 2026. Electricity and gas top the list of the 15 critical infrastructure sectors, and designated operators will be legally required to notify the government of their system assets and to report cyber incidents to the government.

Looking back at cyberattacks around the world, energy is the sector where the most serious real-world damage has occurred. In Ukraine in 2015, a power company's control systems were manipulated, causing a large-scale blackout. In the US in 2021, a major fuel pipeline was hit by ransomware and halted operations for about five days, causing fuel shortages on the East Coast.

In response to these developments, Japan's electricity and gas industries have been among the earliest critical infrastructure sectors to develop legal frameworks and guidelines. The new Act adds a new layer on top of that: an obligation to report to the government.

This article organizes what incident response electricity and gas utilities will be expected to carry out in practice, across three layers: the Act itself, industrial safety laws, and guidelines.

What the Act makes mandatory: notifications and incident reports

The Act directly applies to specified social infrastructure operators (critical infrastructure operators) designated under the Economic Security Promotion Act; as of April 1, 2026, a total of 257 operators across all sectors have been designated. Electricity and gas have been covered sectors since the system was launched: operators were designated in November 2023, and pre-screening rules for the introduction of specified critical equipment have applied since May 17, 2024.

The Act imposes the following obligations on designated operators. First, for information systems involved in core operations that qualify as "specified critical computers," they must notify the government of details such as vendor names and product information. Second, they must file incident reports when they suffer a cyberattack.

As for the reporting framework, the draft approach toward implementation presented to a Cabinet Office expert panel calls for two-stage reporting. Upon becoming aware of an incident, an operator promptly submits a "preliminary report," followed by a "detailed report" within 30 days. In both cases, operators only need to report what they know at that point; a perfect root-cause analysis is not expected in the initial response.

Reportable events include not only traces of "specified unauthorized acts" such as unauthorized access, but also events that could lead to them. The design triggers the reporting obligation from the early-warning stage.

How cloud usage is handled has also been clarified. For SaaS and PaaS (covering middleware and operating systems), "awareness" is deemed to occur when the cloud provider sends a notification. Operators with areas that are increasingly moving to the cloud, such as customer management and billing, need to decide in advance who receives outage and breach notifications from vendors, and the procedure for feeding them into the reporting flow.

The penalties are not to be taken lightly either. Violating the notification obligation and failing to comply with a corrective order from the supervising ministry can result in a fine of up to JPY 2 million, and failing to respond to requests such as for the submission of materials can result in a fine of up to JPY 300,000.

Operators that are not directly designated are not off the hook either. It has been pointed out that IT vendors and group companies contracted to operate specified critical computers, and depending on the system configuration, equipment owned by contractors, may also be covered.

In the electricity industry, where generation, retail, and transmission/distribution have been unbundled and operations are increasingly outsourced to group companies, and in the gas industry, where joint transportation and contract manufacturing are common, it's entirely conceivable that a company could become involved in the system as a "contractor to a designated operator."

What industrial safety laws "already" require

As electricity and gas practitioners know, the Act is not the first cybersecurity regulation in this industry. In fact, this is the critical infrastructure sector where mandatory standards were introduced earliest.

For electricity, Article 15-2 of the Ministerial Ordinance Establishing Technical Standards for Electrical Equipment requires that cybersecurity be ensured for computers that manage the operation of electrical facilities for business use, so that there is no risk of harm to people, damage to property, or significant disruption to the supply of electricity.

This provision was introduced in a 2016 amendment, and the interpretation of the technical standards states that compliance shall be "based on" specific guidelines such as the Electric Power Control System Security Guidelines. A further amendment in June 2022 (effective that October) extended coverage to electrical facilities for private use, and owners of covered facilities are now required to specify cybersecurity measures in their safety regulations.

For gas, an amendment to the Ordinance for Enforcement of the Gas Business Act (promulgated in 2019) positioned ensuring cybersecurity for computers that manage the operation of gas facilities as an item that must be included in safety regulations. Under this approach, safety regulations, the foundation of safety activities, are placed at the center of legal compliance. The Japan Gas Association has also developed industry guidelines, the Security Guidelines for Control Systems Related to Production and Supply, to support operators in creating their internal rules.

In addition, the so-called smart safety-related legal amendments promulgated in 2022 (partial amendments to the High Pressure Gas Safety Act, the Gas Business Act, the Electricity Business Act, and others) introduced a mechanism allowing the government to request the Information-technology Promotion Agency, Japan (IPA) to investigate the cause when a serious cybersecurity event related to safety occurs or is suspected. A framework for government involvement in the "aftermath" of an incident is already built into industrial safety law.

In other words, for electricity and gas utilities, the Act is not an obligation starting from zero. It's more accurate to see it as adding the practice of "promptly reporting to the government upon becoming aware" on top of the measures they have built up through safety regulations and technical standards.

"Incident response in practice" as described by the guidelines

The Ministry of Economy, Trade and Industry (METI), the Agency for Natural Resources and Energy, and industry associations have developed multiple guidelines for electricity and gas. In the electricity sector, the Electric Power Control System Security Guidelines require planning, implementing, checking, and improving security measures based on the PDCA cycle. In March 2024, the Agency for Natural Resources and Energy published the Cybersecurity Risk Inspection Guide for Electric Power Systems, containing 108 risk inspection items based on the functions and categories of the NIST CSF. The guide is premised on the recognition that while guidelines are helping advance security measures, threats evolve every day and current measures are never sufficient.

Here are the key points to keep in mind from an incident response perspective.

• Assume IT damage can cascade into a supply outage
  The US pipeline case is emblematic: even when ransomware infects business (IT) systems, a company may be forced into a management decision to shut down the supply side (OT) because it can no longer ensure safety or manage billing and shipments. "The control systems are fine, so we can keep supplying" doesn't always hold.
  
  The core of incident response for energy operators is deciding in peacetime who decides, and how, whether supply can continue when an IT-side incident occurs, along with the criteria for that decision.
• Don't place too much faith in the boundary between OT and IT
  In the 2015 Ukraine blackout, control systems that were logically separated by firewalls and VPNs were manipulated over the VPN using legitimate credentials stolen via business workstations.
  
  The growing number of connection points from maintenance VPNs, remote monitoring, and the advance of smart safety expands the attack surface even as it improves efficiency. The 2022 amendment, which extended the technical standards to electrical facilities for private use, was nothing other than a response to the broadening base of risk brought about by the spread of remote monitoring and control.
• Record and act from the early-warning stage
  Reportable events under the Act include even "events that could lead to" specified unauthorized acts. Anomalies picked up by monitoring of both control and information systems need to be recorded chronologically and fed into the line that decides whether reporting is required. The question is whether you can run this entire flow fast enough to meet the preliminary report deadline.
• Make full use of information-sharing frameworks
  The electricity sector has industry information-sharing frameworks such as the Electricity ISAC and CEPTOAR, and the gas sector has also built up knowledge sharing and drills through CEPTOAR. Once the Act takes effect, multiple channels will run in parallel: statutory reports to the government, cooperation with IPA investigations, and information sharing within the industry. Which information goes where, and on whose decision? Sorting out your points of contact in peacetime can greatly reduce confusion in a crisis.

What to do before the Act takes effect

With the October 2026 effective date in view, the to-do list for designated (or potentially designated) operators comes into focus.

1. Take inventory of assets
   Identify the specified critical computers and peripheral equipment that may be subject to notification. This includes not only supervisory control, power dispatch operations, and production and supply control systems, but any system whose compromise could halt or degrade supply operations, identified by working backward from the magnitude of impact. Equipment lists created for pre-screening under the Economic Security Promotion Act should serve as a ready starting point.
2. Establish the reporting flow
   Build into your emergency response plan the definition of awareness (including notifications from cloud vendors), who drafts the preliminary report and the approval route, and the investigation structure for the detailed report due within 30 days. Electricity and gas already have accident reporting systems under the Electricity-Related Reporting Rules and the Gas Business Act, which differ from reporting under the Act in both purpose and recipient. Assuming multiple reports will run for the same incident, unify your recording format so that "once recorded, it can be expanded into the reports for each system."
3. Leadership involvement
   The decision of whether to halt supply due to IT-side damage can't be shouldered by frontline staff or the IT department alone. As the obligation to specify cybersecurity in safety regulations shows, security in this sector is safety itself, which is to say a matter of management responsibility. Positioning approval of the incident response plan and participation in drills as part of leadership's job is the finishing touch before the Act takes effect.

Some details of the law are still being worked out through cabinet orders, ministerial ordinances, and operational rules ahead of the effective date, and items described as "draft" in this article may change. Please check the latest information in materials published by the Cabinet Office (offices in charge of cybersecurity and economic security), METI, and the Agency for Natural Resources and Energy.

That's where Incident Lake comes in

As we've seen, what really creates the burden of complying with the Act is less the rule-making in peacetime than "the practical work from the very moment an incident occurs." Organizing the facts you've become aware of and promptly issuing a preliminary report, keeping a chronological record in parallel with decisions on whether to continue supply, compiling a detailed report within 30 days, and handling reports to multiple recipients, including statutory reports to the government, existing accident reports, and information sharing within the industry: at a moment when you should be pouring everything into keeping supply running, there's hardly any capacity left to devote people to reporting.

Incident Lake is an incident management platform that supports this entire flow. It automates the response when an incident occurs, from reporting through recovery, as well as creating and managing reports, so that the people in charge can spend their time on what they should really be focused on: "protecting and restoring supply." Now that deadline-driven reporting such as preliminary and detailed reports is being put into effect as a legal system, we recommend reshaping your reporting and recording processes so they don't depend on individual heroics.

References

• Ministerial Ordinance Establishing Technical Standards for Electrical Equipment (Ordinance of the Ministry of International Trade and Industry No. 52 of 1997), Article 15-2
• METI, "Ensuring Cybersecurity for Electrical Facilities for Private Use" https://www.meti.go.jp/policy/safety_security/industrial_safety/sangyo/electric/detail/cybersecurity.html
• Agency for Natural Resources and Energy, "Cybersecurity Risk Inspection Guide for Electric Power Systems" (March 2024)
  https://www.meti.go.jp/press/2023/03/20240322003/20240322003.html
• Agency for Natural Resources and Energy, "Cybersecurity in the Electric Power Sector" (April 17, 2024, materials for the Electricity and Gas Basic Policy Subcommittee) https://www.meti.go.jp/shingikai/enecho/denryoku_gas/denryoku_gas/pdf/073_07_00.pdf
• METI Industrial Safety Group, "Initiatives to Improve Cybersecurity Response in the Gas Sector" (March 2019, materials for the Gas Safety Subcommittee) https://www.meti.go.jp/shingikai/sankoshin/hoan_shohi/gas_anzen/pdf/019_04_02.pdf
• Cabinet Office, "System for Ensuring the Stable Provision of Critical Infrastructure Services" https://www.cao.go.jp/keizai_anzen_hosho/suishinhou/infra/infra.html
• Director General for Policy Planning (Cybersecurity), Cabinet Office, "Draft Approach Toward Implementation of the Active Cyber Defense Act (Public-Private Partnership)" (December 2025) https://www.cao.go.jp/cybersecurity/kaigi/pdf/04shiryo05.pdf
• Nikkei xTECH, "Active Cyber Defense Act Takes Effect in October, with the Risk of Being Dropped by Business Partners" (2026) https://xtech.nikkei.com/atcl/nxt/column/18/00989/042300207/

About the author
Takaaki Kanetsuki, President and CEO

Representative Director, SIGQ Inc.
Completed graduate studies at the University of Tsukuba, specializing in databases and distributed systems.
An engineer who works with operational data, the unstructured, real-time information that is essential in the AI era.
Joined Money Forward, Inc. as a new graduate, working in management and development at development sites in Japan and abroad, including a secondment to the company's Vietnam office.
Joined PLAID, Inc. in 2022, where he was responsible for Platform Engineering and worked on developing large-scale distributed data systems.
Founded SIGQ Inc. in 2024.