J-POWER reviews and enhances its cybersecurity measures on an annual basis and implements them in accordance with a yearly action plan. Our principal cybersecurity measures are as follows.

1. Governance and Organization

• Established the Group Cybersecurity Promotion Committee, a cross-Group body chaired by the Group Chief Cybersecurity Officer, an Executive Officer appointed by the President.
• Established the Group Cybersecurity Promotion and Response Team (Group CSIRT), led by the General Manager of the Digital Innovation Department, to promote and coordinate cybersecurity initiatives throughout the J-POWER Group.
• Designated the Digital Innovation Department as the central body responsible for cybersecurity governance and the development and maintenance of related policies and standards.
• Maintains a crisis management framework to ensure a prompt and effective response to cybersecurity incidents.
• Conducts cybersecurity risk assessments across J-POWER and its Group companies and implements improvement measures based on the assessment results.

2. Human Resource Measures

• Provides cybersecurity awareness and training programs, including e-learning courses and phishing simulation exercises, for all directors, officers, and employees of the J-POWER Group.
• Provides specialized cybersecurity education for senior management and supports participation in external training programs and seminars for CSIRT members.
• Conducts Group-wide cybersecurity incident response exercises.

3. Physical Security Measures

• Operates a pre-registration security gate system at the Head Office.
• Controls access to office areas through IC card employee identification badges at the Head Office.
• Maintains physical separation between office workspaces and meeting/reception areas.

4. Technical Security Measures

• Prevents unauthorized access from the internet through multiple layers of security controls.
• Implements access control and user authentication for business systems.
• Uses anti-malware solutions to scan computers and externally introduced electronic storage media.
• Detects and blocks unauthorized or suspicious network communications.
• Requires managerial approval and file encryption when electronic information is transferred outside the company.
• Performs security screening of email communications.
• Encrypts corporate computers and devices.
• Detects unauthorized devices connected to corporate networks.
• Applies software and operating system updates on a regular basis.
• Collects and monitors system and operational logs.