As cited
Copy frozen at (site build).
government policy
Japan Adopts Proactive Cyber Defense Strategy
Japan has enacted an Active Cyber Defense framework through two 2025 statutes that shift from voluntary incident reporting to mandatory disclosure, government communications analysis, and limited infrastructure disruption authority. Designated critical infrastructure operators in sectors including electricity, telecommunications, transport, and finance must notify the government about covered systems and report qualifying incidents beginning October 1, 2026; government communications-collection capacity enters force November 23, 2027. The framework reflects sustained growth in foreign-origin cyberattacks against Japanese entities, with Japanese authorities recording an elevenfold increase in attack packets between 2015 and 2024 and attribution to Chinese strategic collection, North Korean revenue operations, and Russian espionage.
Why it matters: Critical infrastructure operators, vendors, carriers, and hosting providers in Japan and those supporting Japanese operations face new mandatory incident reporting duties, contracting obligations, and government intelligence-sharing requirements effective October 1, 2026; organizations should review their incident escalation, evidence preservation, and supply-chain processes to address heightened government visibility and cross-border reporting triggers.
- Source published
- First seen by Cybersecurity Tracker