CYBERSECURITY EMERGENCY PACKAGE
When a government support team arrives,
can you show what happened from one record?
On November 6, Japan adopted its Cybersecurity Emergency Package. Organizations hit by an attack will be asked to brief government support teams, report to the competent ministries and update stakeholders, all at the same time. Incident Lake takes you from first response in Slack or Teams to draft regulatory reports, on one shared record.
- Reporting deadlines
- Timeline
- Impact map
- Approved mass notifications
- Drill scenarios
Support is getting stronger, and so are the requests to explain and report. In the middle of a response, nobody has time to scroll back through chat to build a briefing. Incident Lake records conversations and decisions as you respond, so the answers are ready when someone asks.
You already know what they will ask
What happened, and how far it reached
The damage and the timeline since you became aware. Affected services, business processes and suppliers. Answered from the timeline and the CMDB impact map.
What you are doing, and who you told
Current measures, owners and open tasks. Updates to executives, customers and suppliers stay on record as approved mass notifications.
What you reported, and when
Deadlines and filing status under the APPI, the My Number Act, the Cyber Response Capability Enhancement Act and GDPR. Deadlines show up as cards, and reports are drafted from the response record.
From detection to the first report draft, on one record (ransomware example)
What lies ahead for affected organizations
Key dates from the Emergency Package and related laws. Team names are provisional, and some dates are government targets. Obligations under the Cyber Response Capability Enhancement Act apply to designated critical infrastructure operators.
Oct 1, 2026 | Reporting and filing provisions of the Cyber Response Capability Enhancement Act take effect
Designated critical infrastructure operators must file a preliminary report on becoming aware of a specified incident, and a detailed report within 30 days.
Nov 2026 | Outreach team launched
Based on threat analysis, the National Cybersecurity Office may contact organizations at risk of compromise.
By end of 2026 | Threat-hunting manual and detection tools released
Operators whose compromise would have a large impact will be encouraged to hunt for traces of attack.
Jan 2027 | Revised PPC guidelines on security control measures take effect (target)
Organizations will need to review their security control measures.
Mar 2027 | Security assessment scheme launches; Article 4 filing deadline
The supply-chain security assessment scheme starts around March, and assessed companies may be asked for information after an incident. Covered operators must file their existing equipment by March 31.
FY2026 | Secretariat for the public-private cyber rescue team; Joint Response Team begins operating
Government teams are sent to affected organizations to hear about the damage and the response.
Turning government action into day-to-day practice
Of the package's four pillars, here is what lands on an affected organization, and how Incident Lake supports it. People still confirm severity and submit reports.
Briefing support teams
Conversations, alerts and decisions on one timeline. The meeting bot adds call summaries to the notes, so you can answer in a single briefing.
Regulatory reports on time
Preliminary and final deadlines are calculated from when you became aware, and reports are drafted field by field from the law. Your team decides whether to report and files it.
Explaining your decisions
Decisions stay on the timeline and actions in the audit log, so you can show who decided what, and when.
Impact, including suppliers
The supplier breach impact map shows which of your services and business processes a supplier's breach affects. The configuration behind each decision is kept in history.
Updating customers and suppliers
Mass email with an approval step, plus Statuspage integration. Who received what stays on the record.
Rehearsing first response
Run drills from scenarios for 14 industries and get the debrief drafted. Emergency response plans lay out each step on a timeline before anything happens.
Try it on one of your own incidents
Import a past Slack thread during the trial and see the timeline and report drafts it produces.
Start free trialRegulatory references are general information, not legal advice. Confirm whether and when to notify with your counsel and the relevant authority. See compliance deadlines for GDPR, DORA and NIS2 timelines.
Keep your platform for prevention and records. Add first response and reporting.
Incident Lake does not replace your monitoring, alerting or ticketing platform. If you use ServiceNow, records, approvals and the CMDB stay there as the system of record, and Incident Lake handles first response and reporting.
Asset inventory, vulnerability scanning and remediation
Handled by your ITSM and assessment vendors. Incident Lake does not cover this area.
First-line triage of high-volume alerts
Handled by your SIEM/EDR and SOC. Incident Lake picks up incidents escalated from the SOC.
Isolating devices and blocking traffic
Handled by your security products and staff. Incident Lake does not run containment automatically.
Formal records and approvals
Kept in ServiceNow or your ITSM. Tasks and records sync and link within the scope an admin enables.
First response and stakeholder updates
Run by Incident Lake in Slack or Teams threads, confirming commander, severity and impact in turn.
Deadline tracking and drills
Handled by Incident Lake. Your team decides whether to report and files it.
Incident records are your most sensitive information
Root causes, vulnerabilities, customer impact. We publish how the service is run and how data is handled, so you can check before you trust us with it. Permission groups come with Team and above, audit log and SAML SSO with Annual plans, and Self-Hosted with the Annual plan's Custom tier.
Independent assurance
Incident Lake has received a SOC 2 Type 1 report and is undergoing a Type 2 audit. SIGQ, the operator, is ISO/IEC 27001 certified.
Run it in a closed network
Self-Hosted runs inside your environment, including our in-house model Otter, and uses no external LLM API for inference.
Control who gets in
SAML SSO and IP restrictions. Sign in through your own identity provider.
Control what they see
Per-feature permission groups and RBAC tags separate viewing, editing and admin rights.
Keep a trail
The audit log shows who did what, and when. Integration secrets are encrypted per tenant.
AI proposes, people decide
People confirm severity, contain incidents and submit external reports. Connections to monitoring, code and docs are read-only.
FAQ
Can you scan for vulnerabilities or preserve logs?
No. Incident Lake covers response and reporting after an incident. Preserve the logs themselves in your monitoring and logging platform.
Are you affiliated with the government programs?
No. This page summarizes what organizations can prepare in response to the Emergency Package, mapped to our product.
We are not covered by the Cyber Response Capability Enhancement Act.
Deadline tracking and drafts also cover breach reports under the APPI and the My Number Act.
We use ServiceNow.
Use both. Records and approvals stay in ServiceNow, while Incident Lake runs first response and reporting deadlines.
Does AI submit the reports?
No. AI calculates deadlines and drafts. People decide whether to report, finalize the content and file it.
We can't let data leave our environment.
Self-Hosted is offered on the Annual plan's Custom tier and runs inside your environment, including our in-house model Otter.
Source: Cybersecurity Emergency Package (adopted by the Ministerial Meeting on Cybersecurity, November 6, 2026). Government team names are provisional, and timing and details may change. This page does not indicate any partnership with or endorsement by government programs. Statements about laws are general information, not legal advice. Check official guidance and consult experts on whether and when to report.
FREE TRIAL
Try it for free
and see for yourself
Two fields, about two minutes. We set up your workspace and email the login, usually within one to three business days. No sales call unless you ask for one.