Risk Management

The following risks are assumed to be the risks revolving around the business.

The Group has formulated a “business continuity policy” that places the highest priority on confirming and ensuring the safety of employees and their families, maintaining the supply of parts and materials necessary for customers to continue operations, and protecting human life and conducting rescue and recovery activities in the region. We review and adjust the Company’s business continuity plan (BCP) and plant BCPs on this basis. Taking changes in the external environment into account, we continue to review and detail BCPs and manuals from a practical standpoint, as well as measures to ensure the continuity of product supply and service provision, in addition to seismic reinforcement measures at the level of each department, including general affairs, production management, manufacturing, and IT.

We have introduced a “Safety Confirmation System” for confirming people’s safety via mobile phones and smartphones following a disaster or accident. We explain the system to new employees and enforce early registration. We carry out operation drills twice a year (in June and December) to confirm the system’s effectiveness and to raise awareness of the system among all employees, and use the drill results to perform reviews and disseminate information. In addition to the conventional safety confirmation via e-mail, we allow the use of the safety app and messenger app as well to improve the response rate for safety confirmation e-mail and prepare for e-mail reception delays and rejections when actual safety confirmation e-mails are sent out.

Considering it our responsibility to protect the information assets entrusted to us by valued customers and business partners as well as our own information assets, we have the basic policy on information security in place as information protection guidelines.
To promote information security, we have the Information Security Committee, chaired by the Head of Administration Company, with an officer in charge of information security, an information security manager, and Security Subcommittee assigned to each company. Group companies also participate in the committee.
Furthermore, we have set up a new dedicated team called “ACCT-CSIRT” to protect our information from cyber attacks that have been becoming increasingly sophisticated and advanced in recent years. The team is responsible for a series of operations, from vulnerability monitoring and incident prevention in times of peace to rapid recovery and close coordination with external experts during an incident. They review the incident response manual regularly to enhance the security system.

We also strive to reduce the risk of leakage of confidential information and personal information resulting from the diversification of work styles, including the widespread adoption of telecommuting. In addition to the regular information security training (e-learning), we conduct targeted attack email drills on a continuous basis to improve the security literacy of individual employees and raise their security awareness.

We reviewed our information security systems to strengthen our management foundation in a sustainable way. Specifically, we have reinforced and clarified the “ACCT-CSIRT” response flow and coordination system to ensure rapid and adequate incident response. Also, to further increase the effectiveness of security governance, we have streamlined the roles and responsibilities of the Information Security Committee, specialized committees, and individual sites.
Moreover, to address the risks involved in global business expansion, we have established a centralized reporting and coordination route, including the domestic and overseas group companies, ramping up coordination with overseas sites. We have also changed the “information security system chart” to create a new one that reflects these initiatives and covers the entire group. 

To counter the threat of cyber attacks that grows increasingly serious year after year, we have a 24/7 monitoring system in place using an external SOC, as well as a dedicated team called “ACCT-CSIRT” for quick incident response. Furthermore, we conduct a simulation drill and a capability evaluation meeting regularly based on ransomware infection and other security breach scenarios. By reviewing the response capabilities and issues of the individual departments, we strive to upgrade the risk management process and enhance governance in terms of information security. In fiscal 2025, we established the ACCT-CSIRT system and created an operation standard. We also set rules regarding the incident response process (triage, impact scope identification, containment, etc.).

We check the entire Tokyo Seimitsu Group to see whether each group company complies with information security-related management regulations and standards. In fiscal 2025, we audited six overseas subsidiaries to ensure compliance with the regulations and standards.

We have “supplier information security standards” in place to raise the security level of the entire supply chain. Based on results of the annual questionnaire surveys on information security, we provide suppliers with individual feedback reports and countermeasure manuals. We also share survey analysis results through supplier briefing sessions and CSR seminars to encourage suppliers to establish an emergency communication system and enhance security. We aim to raise the security level of the entire supply chain by having suppliers recognize it as a common management issue to address the business continuity risks resulting from cyber attacks.