March 8, 2023 Results of Solicitation of Opinions on Draft Guidance for Sharing and Disclosure of Information on Damage from Cyberattacks and Publication of Guidance for Sharing and Disclosure of Information on Damage from Cyberattacks

The Study Group on Guidance for Sharing and Disclosure of Information on Damage from Cyberattacks (chaired by HOSHI Shuichiro, professor, Tokyo Metropolitan University; secretariat: Ministry of Internal Affairs and Communications (MIC), National center of Incident readiness and Strategy for Cybersecurity (NISC) of the Cabinet Secretariat, National Police Agency (NPA), Ministry of Economy, Trade and Industry (METI), and Japan Computer Emergency Response Team Coordination Center (JPCERT/CC)) established under the steering committee of the Cybersecurity Council has undertaken deliberations aimed at the formulation of practical guidance for use when organizations that have suffered cyberattacks share information about the damage caused by the cyberattack with cybersecurity organizations.
The study group has recently formulated the Guidance for Sharing and Publication of Information on Damage from Cyberattacks and the guidance is hereby published.

1. Overview

The Study Group on Guidance for Sharing and Disclosure of Information on Damage from Cyberattacks established under the steering committee of the Cybersecurity Council has met five times since April 2022 for discussions aimed at the formulation of practical guidance for use when the relevant departments at organizations that have suffered cyberattacks (e.g. systems administration departments, security departments, and legal affairs and risk management departments) share information about the resultant damage. The draft Guidance for Sharing and Disclosure of Information on Damage from Cyberattacks was subsequently compiled on the basis of the outcomes of deliberations and, as a result of the public solicitation of opinions on the draft from Tuesday, December 27, 2022 through Monday, January 30, 2023, 17 parties submitted opinions on 46 matters.
Taking the submitted opinions into consideration, the study group undertook further deliberations and finalized the Guidance for Sharing and Disclosure of Information on Damage from Cyberattacks. Accordingly, MIC has decided to release the guidance, together with the submitted opinions and the study group's views on the opinions.

2. How to obtain reference information

MIC will post the reference information on the public comment page of the e-Gov (https://www.e-gov.go.jp/en/ ).

3. Future plans

MIC will encourage the smooth, effective sharing of information regarding the damage caused by cyberattacks by promoting widespread circulation of the Guidance for Sharing and Disclosure of Information on Damage from Cyberattacks via forums such as the Cybersecurity Council, and will also consider revising the guidance as needed in due course.

• *
  The published materials are in Japanese only.