RESEARCH REPORT
Resilience Requirements and Security Investment: What Companies Need to Know
Demands for resilience are rising on several fronts at once, from global regulations to Japanese government agencies. Cybersecurity is shifting from a technical issue for front-line teams to a management issue that executives are accountable for. This report organizes the requirements of domestic and international guidelines into an 8-dimension, 5-level maturity matrix, and explains how to assess where your organization stands, how to step up, and how to think about security investment.
Download the full reportKEY FINDINGS
Survey findings: incident response depends on a few individuals
Our survey found that incident response often depends on key people who may leave. The most common reason this dependency persists is that it is not a priority for the organization. Preparing for incidents that threaten business continuity is being left to front-line teams.
72.0%
say incident response is concentrated on one or two specific people
88.9%
say those key people may leave, change jobs or transfer within 1–2 years
32.4%
tried to reduce this dependency, but saw no improvement
69.6%
are open to adopting a tool or platform that reduces this dependency
Source: Survey on Individual Dependency in Incident Response 2026 (n=250; people involved in system incident response at companies). "Tried but saw no improvement" was the most common answer to that question.
MATURITY MODEL
A resilience maturity matrix: 8 dimensions × 5 levels
Our own maturity model for gauging how well you meet the requirements of domestic and international guidelines. It is built on the elements common to major regulations and on the ideas behind CMMI, the software maturity model.
Level 1
Unmanaged
No defined procedures or owners; response is ad hoc
Level 2
Person-dependent
Runs on the experience and intuition of specific people
Level 3
Department-managed
Organized within a department, but weakly connected across teams and to leadership
Level 4
Organization-managed
Responsibilities, decisions and drills are organized company-wide, including leadership
Level 5
Continuously managed
Recording, analysis and improvement run continuously, so response capability keeps improving
① Governance and accountability
Are decision-makers for major incidents, executive reporting lines and cross-team responsibilities defined?
② Assets, critical operations and dependencies
Do you know how critical operations relate to the systems, vendors, cloud services and identity platforms behind them?
③ Attack surface reduction
Are internet-facing assets, privileged accounts, vulnerabilities and misconfigurations inventoried and prioritized?
④ Observability
Are logs, alerts and response records consolidated so you can trace impact and similar past cases?
⑤ Evidence and auditability
Do response records serve as evidence you can later explain to auditors, risk managers, regulators and customers?
⑥ Availability of response tools
Can you still communicate, record and make decisions during a production outage?
⑦ Recoverability
Are RTO/RPO, recovery priorities and manual workaround procedures defined, drilled and tested?
⑧ Decision records and continuous improvement
Are decision rationale, prevention measures and open risks structured and fed into executive reporting and improvement cycles?
* The full report maps each dimension to public and international frameworks such as NIST CSF 2.0, DORA, the FSA guidelines and ISO 22301.
WHY LEVEL 2–3
Five barriers that keep companies at Level 2–3
Companies at Level 2–3 are not doing nothing. The problem is that front-line effort is not being turned into organizational capability, executive decision-making and accountability.
01
Talented teams keep things running
"Just ask them" becomes the norm, and dependency on individuals grows as a by-product of their skill.
02
Having documents feels like enough
BCPs and runbooks are written and shelved; no one can say when they were last actually used.
03
Hard to budget for
Success means nothing happened, so ROI is hard to show and revenue-generating projects win.
04
Hard to work across departments
No cross-team lines are drawn in peacetime, so who decides what is only discussed once a crisis hits.
05
No plan for explaining to outsiders
The impact, timeline and rationale needed to brief customers, regulators and partners are not recorded in a way that can be reconstructed later.
CONTENTS
What's in the report
01Resilience is shifting from "nice to have" to "requirement"
02Are front-line teams ready to respond?
03Self-assessment: an 8-dimension, 5-level maturity map
04Typical Level 2–3 patterns at Japanese companies
05What happens if you stay at Level 2–3: cases from major Japanese companies
06How far leading companies have come: case studies
07Concrete actions to move from Level 2–3 to Level 4–5
08Security investment benchmarks: sizing investment with JCIC guidelines
09A platform that supports front-line response: Incident Lake
10Five questions to discuss internally
APAppendix: overview of regulations and certifications / mapping to major frameworks / details of incidents at major Japanese companies
DOWNLOAD
Download the full report
The full report (PDF, 35 pages, in Japanese) covers domestic and international regulations, typical Level 2–3 patterns with step-up actions for each dimension, case studies from major and leading companies, and JCIC investment benchmarks. You can view it right after submitting the form.
Thank you for your request
You can download the report from the link below.
SIGQ_Resilience Requirements and Security Investment (Japanese PDF)For questions about the report or advice tailored to your organization, feel free to contact us at info@sigq.co.jp.