RESEARCH REPORT
Resilience Requirements and Security Investment: What Companies Need to Know
Demands for resilience are rising on several fronts at once, from global regulations to Japanese government agencies. Cybersecurity is shifting from a technical issue for front-line teams to a management issue that executives are accountable for. This report organizes the requirements of domestic and international guidelines into an 8-dimension, 5-level maturity matrix, and explains how to assess where your organization stands, how to step up, and how to think about security investment.
Download the full reportMATURITY MODEL
A resilience maturity matrix: 8 dimensions × 5 levels
Our own maturity model for gauging how well you meet the requirements of domestic and international guidelines. It is built on the elements common to major regulations and on the ideas behind CMMI, the software maturity model.
アカウント
Unmanaged
No defined procedures or owners; response is ad hoc
権限
Person-dependent
Runs on the experience and intuition of specific people
ネットワーク
Department-managed
Organized within a department, but weakly connected across teams and to leadership
データ
Organization-managed
Responsibilities, decisions and drills are organized company-wide, including leadership
コスト
Continuously managed
Recording, analysis and improvement run continuously, so response capability keeps improving
① Governance and accountability
Are decision-makers for major incidents, executive reporting lines and cross-team responsibilities defined?
② Assets, critical operations and dependencies
Do you know how critical operations relate to the systems, vendors, cloud services and identity platforms behind them?
③ Attack surface reduction
Are internet-facing assets, privileged accounts, vulnerabilities and misconfigurations inventoried and prioritized?
④ Observability
Are logs, alerts and response records consolidated so you can trace impact and similar past cases?
⑤ Evidence and auditability
Do response records serve as evidence you can later explain to auditors, risk managers, regulators and customers?
⑥ Availability of response tools
Can you still communicate, record and make decisions during a production outage?
* The full report maps each dimension to public and international frameworks such as NIST CSF 2.0, DORA, the FSA guidelines and ISO 22301.
WHY LEVEL 2–3
Five barriers that keep companies at Level 2–3
Companies at Level 2–3 are not doing nothing. The problem is that front-line effort is not being turned into organizational capability, executive decision-making and accountability.
決める
Talented teams keep things running
"Just ask them" becomes the norm, and dependency on individuals grows as a by-product of their skill.
守る
Having documents feels like enough
BCPs and runbooks are written and shelved; no one can say when they were last actually used.
つくる・動かす
Hard to budget for
Success means nothing happened, so ROI is hard to show and revenue-generating projects win.
CONTENTS
What's in the report
01Resilience is shifting from "nice to have" to "requirement"
02Are front-line teams ready to respond?
03Self-assessment: an 8-dimension, 5-level maturity map
04Typical Level 2–3 patterns at Japanese companies
05What happens if you stay at Level 2–3: cases from major Japanese companies
06How far leading companies have come: case studies
DOWNLOAD
Download the full report
The full report (PDF, 35 pages, in Japanese) covers domestic and international regulations, typical Level 2–3 patterns with step-up actions for each dimension, case studies from major and leading companies, and JCIC investment benchmarks. You can view it right after submitting the form.
Thank you for your request
You can download the report from the link below.
SIGQ_Resilience Requirements and Security Investment (Japanese PDF)For questions about the report or advice tailored to your organization, feel free to contact us at info@sigq.co.jp.