Based on the OKI Group Security Basic Policy, the OKI Group has established a system to ensure information security and works to properly manage and protect company and customer information. OKI's Information Planning Division reviews all activities related to information security, and each business unit or group company has a information security promotion team that is responsible for addressing the measures decided by OKI's Information Planning Division.
We have also established relevant rules and regulations for information security. We have examined customer information and data to be processed within the group, defined the types of information to be treated as confidential, and formulated regulations, administrative instructions and guidelines related to the processes of acquiring, generating and discarding such information.
In the OKI Group we use the three perspectives shown in the diagram below to broadly promote information security measures for computers, networks and information systems.
As part of its systems for information protection, the OKI group offers information security education to all employees who use the information infrastructures belonging to the group. Each and every individual is asked to thoroughly protect information assets received from customers as well as highly confidential information assets belonging to OKI. For this reason, we widely communicate basic regulations and rules, and company standards regarding the use of our information networks, desktop computers and mobile computers through group training sessions and e-learning programs.
In fiscal 2018, information security training was provided to all employees by e-learning in August. Closely related to this is personal information protection, for which we also provided training at the same time, and almost 100% of employees received this training.
Aiming at an improved information security level across the supply chain, we at OKI continuously verify how information security measures are implemented at suppliers to whom we provide critical confidential information. Here, we ask our suppliers to carry out self-evaluations and to score themselves based on check lists prepared by us. In this way, suppliers and OKI are sharing issues and remedying any problem points found.
We have established an organization specializing in security incident response called OKI-CSIRT(*1), which collaborates with external organizations, such as the Nippon CSIRT Association, CSIRT in other companies and ministries/agencies, in order to enhance our preventive measures against threats to computer security in the group and improve our capacity to respond to them.
In fiscal year 2018, in line with the revisions to the Cybersecurity Management Guidelines, points relating to recovery from a cyber attack were included in the incident response manual and security inspections on contractors were carried out.
Computer Security Incident Response Team
The OKI Group has promoted information security measures at overseas sites, including such actions as laying down information security guidelines in each country and region, appointing security managers at each site, and adopting control tools.
In fiscal year 2018, training on the attachment-style targeted e-mail attacks which had been carried out up until the previous fiscal year was changed to a phishing e-mail format which has been more prevalent in recent years. This training has been conducted not only at sites in Japan, but also in Europe, the United States, China, and Asia.
The OKI Group has acquired the ISMS(*2) certification for divisions involved in building and operating internal information systems, and for divisions engaged in general system design development, in order to improve the reliability of network solution construction and related services (5 companies, 7 divisions as of October 2019).
Information Security Management System
Reports on misuse of public research funds and misconduct related to research
activities can also be filed from the page that opens when you click the above button.