P.77 Risk Management (3)

Risk Management Corporate Governance

Information Security

As businesses expand by utilizing digital technology, the risks of cyberattacks and personal information leaks increase. In response to these heightened risks, the TBS Group is undertaking to strengthen its structure for in- formation security.

Information Security

As cyberattacks become increasingly advanced and sophisticat- ed, cyber security has become an extremely important element of modern broadcasting infrastructure. TBS is a member of the ICT Information Sharing And Analysis Center Japan (ICT-ISAC), a general incorporated association composed of communica- tions companies and broadcasters, and strives to ensure cyber security in broadcasting infrastructure in accordance with ICT-ISAC guidelines. We have established a security framework centered on the TBS Computer Security Incident Response Team (CSIRT), an or- ganization appointed by the Chief Information Security Officer (CISO). TBS CSIRT coordinates closely with information systems divisions across TBS Group companies, JNN network stations, and external security organizations. The CISO regularly reports to the Board of Directors on incident status, progress on security measures, and evaluation results. By sharing and discussing this information, we ensure thorough, management-led governance. TBS CSIRT has established a Security Incident Response Manual that specifies procedures for responding to security incidents. We participate in cross-sector exercises organized by the National Cybersecurity Office (NCO) and in technical training for CSIRTs led by external instructors to continuously train our staff on information-sharing and response procedures in the event of an incident.

Continuous promotion of security measures

TBS Group continuously carries out the evaluation, planning, execution, and improvement of security measures based on the Cybersecurity Framework (CSF), an international framework for the development and advancement of cybersecurity measures issued by the US National Institute of Standards and Technolo- gy (NIST). As a result, we have established a system to prevent security incidents and minimize their impact if they occur. Our security initiatives extend beyond the introduction of the latest technologies to include various approaches, such as targeted email attack simulations and e-learning to enhance employee literacy and the development of information security guidelines to strengthen governance. To strengthen security not only within our organization but across the entire supply chain, we require our business partners to maintain information secu- rity and collaborate with us to mitigate risks through the TBS Group Sustainable Procurement Guidelines and other activities. NIST CSF 2.0 RC ID -Recover- -Identify- GV RS -Govern- PR -Respond- -Protect- DE -Detect- We adopt the NIST CSF and continuously implement security measures across six axes of Govern, Identify, Protect, Detect, Respond, and Recover. Information Security TBS Group companies Management team Reports to Appointment Information systems division/ General affairs and corporate development divisions Incident report Instruct/guide Internal departments Reports to Response support Board of Directors Reports to Supervises TBS HOLDINGS President, Representative Director & CEO Reports to Appointment CISO (Chief Information Security Officer) Reports to Instruct Security management organization: TBS CSIRT Incident report Instruct/guide Internal departments JNN networks External organizations

• NCO
• JPCERT/CC
• ICT-ISAC, etc.

77