Response Awaited from Financial Institutions Regarding Economic Security Promotion Act

◆The Economic Security Promotion Act was enacted on May 11, 2022.

In recent years, there have been many cyber attacks targeting infrastructure companies. Under the Economic Security Promotion Act, prior screening was introduced (to be applied by February 2024) to ensure stable provision of infrastructure services such as electricity, telecommunications, and financial systems when infrastructure companies introduce important facilities (including computer systems, etc.).

If there is a problem, changes of methods of introduction or cancellations of introduction are recommended and ordered.

◆Although the act is expected to reduce the risk of cyber-attacks, it is important to implement comprehensive cyber-security measures, such as taking multiple defense measures to respond to cyber-attacks.

Furthermore, in addition to infrastructure services, it is desirable to consider measures to protect and prevent the outflow of confidential personal data and advanced technologies, which are subject to protection under the U.S. system.

◆The scope of businesses covered by the new law is scheduled to be decided in the future by government ministerial ordinances.

It is advisable for financial institutions which may be subject to the act to investigate whether companies affiliated with China, Russia, or North Korea, which have been pointed out as cyber attack actors, are involved in the design, development, etc. of the computer system to be introduced.