With respect to this theme, more detailed information is also posted in the Cybersecurity Management Report; please refer to that as well.

Cybersecurity Management Report

Governance

Information Security and Cybersecurity Implementation Framework

The NEC Group’s information security implementation framework comprises the Information Security Strategy Committee, its subordinate organizations, and related organizations.
Chaired by the Chief Security Officer (CSO) of NEC Corporation, the Information Security Strategy Committee discusses, evaluates, and improves information security measures, investigates the causes of incidents, sets the direction of recurrence prevention measures, and discusses how to apply the results of its activities in the information security business. The committee also regularly briefs the President of NEC Corporation on the operation status of measures adopted by the committee to obtain approval. In addition, we conduct annual penetration tests via a third-party organization to assess vulnerability risks. We also conduct audits of all external servers four times a year. These actions ensure that vulnerabilities are dealt with in a timely manner.
The CSO and Chief Information Security Officer (CISO) oversees the Cybersecurity Division, which promotes information security measures, and the Computer Security Incident Response Team (CSIRT), which monitors for cyberattacks and resolves incidents quickly whenever they occur. The Information Security Promotion Committee and Working Groups discuss and coordinate measures, ensure that all implementation items are followed, and manage the progress, among other things, based on the security promotion plan.
Managing directors at NEC Corporation have responsibility as information security managers for ensuring information security for the relevant organizations, including the Group companies under their supervision. They work to ensure that rules are understood within their organizations, introduce and deploy measures, while continuously checking and reviewing the implementation progress to improve the situation.
In fiscal year 2025, CSIRT’s Cyber Threat Intelligence (CTI) team gathered and analyzed over 46,000 items of data (IP addresses, file hashes, web addresses and domain names) related to cyber threats within NEC Group to generate threat intelligence. Furthermore, by using CTI to hunt threats, the CTI team is proactively reducing risks.
We have introduced the cybersecurity risk assessments (CRA) framework carried out by the “Red Team,” ¹ and are enhancing our capabilities as an organization by building greater organizational resilience to cyberattacks and strengthening accountability for security management. We have designed attack scenarios based on threats to the NEC Group, ICT usage conditions, incident status and levels of information handled, for which the Red Team conducts surveillance and controlled attacks to assess resilience and risks.

1. A team that conducts simulated cyberattacks mimicking real-world threats against companies and organizations, assesses the organization’s resilience to attacks and risk levels, and recommends improvements and additional countermeasures.

Strategy

NEC evaluates risks from various perspectives including the need for countermeasures as well as possible impacts both on corporate management and on society, and selects Priority Risks that it has evaluated as having major impacts and that need to be addressed. With these risks in mind, we are deploying measures to counter cyberattacks that are becoming increasingly sophisticated, while complying with the U.S. National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0 and Cybersecurity Management Guidelines Ver. 3.0 by Japan’s
Ministry of Economy, Trade and Industry.

Risk Management

At NEC, we leverage the insights and know-how gained from in-house initiatives to create opportunities, providing expertise in security measures to help strengthen customer security strategies.
As a specific example, together with NEC Security, Ltd., NEC offers services that visualize vulnerabilities in externally exposed IT assets at high risk of attacks, as well as authentication information such as IDs and passwords that may have been leaked to the dark web² , all without altering customer IT environments. These services help reduce risks and enhance security.

2. Websites that are not displayed by general search engines, and require special tools or browsers.

Security Risks and Opportunities

The principal risks and opportunities identified by NEC for this theme are as follows:

“Providing Security to Protect the Digital Society from Cyberattacks and Other Threats”

1. Impact on the Environment and Society

1.1. Negative Impact
System shutdown due to cyberattacks, or leakage of customers’ system personal information, etc.

1.2. Positive Impact
Provide system security at the national and societal level to prevent public services from being disrupted.

2. Financial Risks and Opportunities

2.1. Risks
If a significant security incident is caused, the impact will be large.

2.2. Opportunities
Security is a key technology and solution for protecting digital infrastructure.

Risk Management

Information Security Management

To embed information security initiatives across the NEC Group, we have established an information security management system and security policy, both of which we continuously work to maintain and improve.

1. Information Security Risk Assessments

The NEC Group conducts risk assessments and implements countermeasures by analyzing deviations from baseline criteria and carrying out detailed risk analysis, with both methods conducted separately. First, we ensure that security is implemented in line with criteria that serve as a baseline, and when more advanced management is necessary, we conduct a detailed risk analysis and implement finely tuned countermeasures.

2. Risk Management for Information Security Incidents

Information security incidents are subject to mandatory reporting. The contents of these reports are analyzed, and the results are put through a PDCA cycle for risk management assessment. Incident information is centrally managed for the entire NEC Group, and changes in the number of incidents, trends by organization and type of incident, and other data are analyzed. NEC then reflects this analysis in groupwide measures while also measuring the effectiveness of these measures.

3. Critical Information Management

Based on the Three Lines Model, the NEC Group establishes a framework to manage critical information by clarifying the roles of the three lines.
The NEC Group has a framework to classify and manage the confidential information it handles based on the security level. Each organization checks details of all the information it handles, and clearly identifies its security level to ensure that all necessary information is properly managed. We also have rules for handling, storing and managing critical information according to importance, as well as thorough measures to prevent information leakage.

4. AI Security (Security for AI)

Within the NEC Group, we protect AI through three pillars: governance, management, and foundation. In governance, we establish policies, rules, and structures for using AI; in management, we establish processes and guidelines regarding AI usage; and in the foundation, we build systems for managing AI and mitigating AI-related risks.

Addressing Security Risks Arising from Increasing Geopolitical Risks

As the geopolitical situation changes and digital transformation advances rapidly, private companies are also becoming targets of national cyberattacks, and companies that possess critical information such as advanced technological information are facing increasing security risks. The rapidly increasing sophistication and complexity of cyberattacks, along with external factors such as geopolitical risk, may hamper timely mitigation of security risks. These are treated as emerging risks.
In the event that personal or confidential information held by NEC or contained in its products, services, or systems is leaked or exposed through unauthorized access or cyberattacks and used fraudulently, NEC may be subject to disciplinary action by regulatory authorities due to its position of legal responsibility. As a result, NEC may not only lose the trust of its customers as a Social Value Innovator, but its business performance may also be adversely affected. The risk of unauthorized access and cyberattacks exists not only for NEC’s own products, services and systems, but also for those of its customers, contractors, suppliers, business partners, and other third parties.
As a mitigation measure, we are implementing robust and flexible measures throughout the Group based on the US Cybersecurity & Infrastructure Security Agency (CISA) Zero Trust Maturity Model. Based on Cybersecurity Management Guidelines Ver. 3.0 formulated by the Ministry of Economy, Trade and Industry and the NIST Cybersecurity Framework (Version 2.0), we are strengthening intelligence (proactive defense) and resilience (ability to recover from attacks) against cyberattacks. In addition, presenting security risks to all employees on a cybersecurity dashboard as part of our data-driven transformation is supporting quick management decisions and autonomous front-line actions. Thus, we are transforming the expertise and countermeasure doctrines developed through our front-line experience into solutions that we offer to our customers. Furthermore, based on Security by Design, which considers security from the design stage, we are enhancing measures that include our supply chain in order to provide safe, high-quality services.

Establishment of Information Security Rules

NEC has released the NEC Group Information Security Statement and established and streamlined a variety of rules, including overall information security rules, rules for managing corporate secrets, and IT security rules.

Information Security Education and Awareness Training

For all NEC Group employees (including dispatched workers, contractors, and workers with a de facto mandate), in addition to a web-based training course on information security, NEC holds quarterly micro-theme talks. In these sessions, participants watch original videos and discuss the topics in small groups, in an effort to increase information security knowledge and skills. The content of the training is updated every year to reflect trends in security threats, including information management, external security measures, and subcontractor management. In addition, NEC conducts information security surveys to measure awareness of information security in a questionnaire format for all NEC Group employees (including dispatched workers, contractors, and workers with a de facto mandate) to foster a high level of information security culture.

Enhancing Information Security Management at Suppliers

Please see below for more details.

Supply Chain Management

Information Security Certification

The NEC Group has aligned its overall information security rules with the international standard ISO/IEC 27001 (main standard and control measures) and manages information security in accordance with these rules. It has also acquired ISMS certification (ISO 27001) for almost all of its medical, financial, cloud and government and public business units, for which information security is critical.

Providing Secure Products, Systems, and Services

The Company has structured a security proposal implementation framework for secure development and operation of the products, systems and services it provides to customers. This framework involves the Cybersecurity Strategy Department and information security managers in each business division at NEC, and is stipulated in the Cybersecurity Management Rules, alongside security implementation processes. The NEC Group is also promoting the establishment of a security implementation framework and the formulation of Cybersecurity Management Rules similar to those of the Company.
The Company implements security spanning from the planning and proposal phase to the operation and maintenance phase based on the concept of “security by design” (SBD) to ensure security. In the development of products, systems, and services, we create and utilize checklists to confirm that security tasks are being implemented in each phase. Based on these checklists, operational projects are managed and the status of security measures is efficiently inspected and monitored through the Cybersecurity Checklist Management Security Implementation Assessment System developed to centrally manage and visualize the implementation status of security. In the operation and maintenance phase, we ensure security by collecting and distributing information on vulnerability in a centralized manner and by providing it to business divisions and customers.

Furthermore, as a measure to address security vulnerabilities, we have established the Product Security Incident Response Team (PSIRT) to collect and handle information on vulnerability related to NEC Group products. We appropriately handle such undisclosed vulnerability information regarding our products by publishing a vulnerability disclosure policy and having a point of contact for external inquiries. In addition, in order to facilitate information sharing including the NEC Group engaged in manufacturing, we have established the NEC Group PSIRT Community and are working to ensure that PSIRT activities function across the entire NEC Group.
The Company has also established a cloud-based software development platform as our standard internal environment for system development. This platform utilizes security vulnerability testing tools and other tools that streamline and automate security implementation to improve the productivity, quality, and security of system development. In addition, by consolidating the development environments of our supply chain, including operational projects and subcontractors, into this platform, we have centralized security management for those development environments to address risks such as information leaks during development and copyright issues arising when using generative AI.

Measures Against Cyberattacks

As cyberattacks grow increasingly complex and sophisticated, the NEC Group focuses on protecting information assets entrusted by customers and business partners, as well as its own. To this end, the Group has implemented comprehensive cybersecurity management by implementing uniform, advanced measures worldwide based on cybersecurity risk analysis and has established an incident response framework with CSIRT.
Given that the NEC Group creates and provides social solutions for countries worldwide, an information security incident caused by a cyberattack or any other factor could diminish the social credibility of the entire NEC Group and significantly impact its business management. For this reason, the Group considers a comprehensive and global approach to cybersecurity risks to be essential for business continuity.
The NEC Group is strengthening its global measures against increasingly sophisticated cyberattacks while using generative AI and other technologies based on a multilayered defense approach.

1. Cyber Risk Assessments by the “Red Team”

• Regular cyber risk assessments are conducted by the Red Team with the aim of improving the NEC Group’s cyber resilience and accountability.
• A global assessment consisting of three investigations on 1) the management status of critical information, 2) risks that include public server vulnerabilities and data leakage, and 3) internal and external security breaches from an attacker’s point of view, is conducted to identify security risks that have been overlooked in security measures and operations, and actions are taken to implement improvements based on these.
• Audit organizations and security specialists are employed to conduct third-party attack diagnoses.

2. Generating and Utilizing Threat Intelligence

• The NEC Group’s cyber threat intelligence (CTI) team consists of specialists who possess an understanding of the threats facing NEC, detects their early signs, and implements advanced proactive defense measures.
• The CTI team leverages the endpoint detection and response (EDR) tools deployed at all NEC Group companies, the network detection and response (NDR) that CSIRT independently developed, and a log analysis platform to hunt for unknown threats.
• The team has also created a research environment to enhance its ability to generate unique CTI proactively, and analyzes threats in detail. Organizational security resilience is enhanced.

3. Enhancing Organizational Security Resilience

• We have developed a manual to ensure rapid responses to ransomware attacks.
• Management, relevant departments and specialists hold training exercises for security incidents at least once every six months.

4. Advanced Cybersecurity Measures Using AI

• We promote the use of AI, including generative AI, and also achieve automation, efficiency, and sophistication in a wide range of fields, including cyber risk assessment diagnostics, threat intelligence generation and utilization, NDR detection, incident investigation, and targeted attack email training.

5. Cybersecurity Dashboard Drives Culture Change

• In order to improve the security awareness of employees, we have made available our cybersecurity dashboard, which visualizes the status of cyberattacks on the NEC Group, threat intelligence information, and the security risk status of each company and division.
• The cybersecurity dashboard is utilized at meetings attended by executives and by all subsidiaries outside Japan to help enable swift management decisions and help security personnel manage more effectively.

Metrics and Targets

FY2031 KPIs

(Scope: NEC Corporation unless otherwise specified, Period: April 2026 to March 2031)
M: Indicates the main non-financial targets related to materiality.

M: Major incidents at NEC Corp. and its consolidated subsidiaries: 0

FY2027 Goals

1.1. Drive Digital Security Transformation (DSX)

• DX security

  • Reinforce AI agent security
  • Reinforce global security platforms
  • Prevent leaks of important information through data loss prevention (DLP)

• Cybersecurity

  • Enhance intelligence through utilization of CyIOC
  • Generate intelligence through deception
  • Automate diagnostics through attack diagnostic AI agents

• Rules and governance

  • Optimize security rules in and outside Japan (risk assessment, rules for overseas subsidiaries, etc.)
  • Assessments for overseas operating subsidiaries
  • Respond to security clearance systems (responses for facilities, people and organizations)

1.2. Establishing, Practicing and Enhancing Governance for Security Proposal Implementation

• Establishment of security implementation rules for systems incorporating AI
• Promotion of PSIRT operations in coordination with Group companies in Japan
• Optimization of the cyber intelligence structure

FY2026 Goals and Results

1. FY2026 Goals

1.1. Drive Digital Security Transformation (DSX)

• DX security

  • Reinforce global security platforms
  • Reinforce AI security (Security for AI)
  • Prevent leaks of important information through AI labeling and data loss prevention (DLP)

• Cybersecurity

  • Enhance global SOC/CSIRT
  • Generate intelligence through deception
  • Automate diagnostics through attack diagnostic AI agents

• Rules and governance

  • Optimize security rules in and outside Japan (risk assessment, rules for overseas subsidiaries, etc.)
  • Enhance internal fraud prevention measures
  • Respond to security clearance systems (responses for facilities, people and organizations)

1.2. Establishing, Practicing and Enhancing Governance for Security Proposal Implementation

• Creation of a PSIRT system in coordination with Group companies in Japan
• Establishment of a security implementation framework and processes at Group companies outside Japan
• Mobility of security personnel and reskilling of personnel responsible for security

2. FY2026 Results

2.1. Drive Digital Security Transformation (DSX)

• DX security

  • Reinforced global security platforms
  • Established systems, revisions, and mechanisms for utilizing AI
  • Implemented measures to detect information leakage risk behaviors using DLP

• Cybersecurity

  • Release of the next-generation cybersecurity service CyIOC
  • Strengthened CTI generation through the building of deception
  • Implemented efficient security operations through utilization of generative AI

• Rules and governance

  • Optimized security rules in and outside Japan (risk assessment, rules for overseas subsidiaries, etc.)
  • Strengthened measures against internal fraud through visualization of information leakage routes
  • Implemented response to security clearance systems

• Received “Two Stars” (highest rating) in the Cyber Index Corporate Assessment 2025

2.2. Establishing, Practicing and Enhancing Governance for Security Proposal Implementation

• Established the NEC Group PSIRT Community in order to facilitate information sharing including the NEC Group engaged in manufacturing
• Completed rollout to seven Group companies outside Japan as model cases for application of security rules to Group companies outside Japan
• As mobility of security personnel, participation (through secondments, etc.) in security-related practical work at external organizations such as government agencies