Daily Japan updates
Cybersecurity policy moves from a public-data warning to draft industrial standards
Japan has opened consultation on an updated cyber-physical security framework while the Digital Agency warns that old contact-form data may have been exposed.
Developments
Two official notices show Japan confronting cybersecurity at different stages: one asks organizations to comment on updated industrial guidance, while the other warns individuals about data that may already have been exposed.
1. METI opens a two-month consultation on CPSF version 1.1
The government has opened voluntary public consultation on a draft update to the Cyber/Physical Security Framework, with comments accepted from October 23 at 16:00 until December 22 at 00:00. The present revision updates the framework’s operational security measures and supporting appendices to reflect newer NIST and ISO standards, including stronger mappings for governance and supply-chain risk. METI also identifies AI agents and AI-enabled attacks as emerging risks, but says fuller changes addressing those risks belong to later revision stages. The document is therefore a proposal, not a binding or final standard. (Open the consultation, Read the official revision overview)
2. The Digital Agency warns that historical contact-form data may have been exposed
The Digital Agency says Studio reported unauthorized access to its cloud environment, creating the possibility that data could be obtained externally. Potentially affected records include several groups of public inquiries and event submissions entered between May 2021 and March 2023, plus 35 agency or contractor Studio accounts. The agency was still determining the actual scope, so its maximum figures should not be read as confirmed leakage totals. It said no secondary misuse had been confirmed at publication and advised people to be cautious about suspicious messages, links, attachments, and requests for credentials or payment information. (Read the Digital Agency notice)
What readers and organizations should take away
The two developments require different responses. Organizations can review the draft framework and decide whether to comment before the deadline; people who previously contacted the Digital Agency through the affected services should treat unexpected communications cautiously without assuming that their own data was necessarily exposed.