Strengthen Cyber Resilience and the Safe and Secure Use of AI

Toshiba Group is engaged in businesses centered on energy, social infrastructure, electronic devices, and digital solutions, helping support people’s lives. We consider it our responsibility to leverage the knowledge and experience we have acquired through manufacturing since our founding, not just in the physical world but also in the online connected society that extends into all areas, in order to strengthen cyber security, protect society, and deliver peace of mind.

Toshiba Group has adopted a concept of “cyber resilience,” which encompasses information, product, control, and data security. The word “resilience” means the ability to bounce back or recover quickly. The term “cyber resilience” means the ability to minimize negative impact and recover quickly in preparation for security incidents such as cyberattacks. To realize cyber resilience, we have defined a set of parameters that contribute to the minimization of the security incident impact on IT systems: 1) P, or preparation for security incidents, 2) M, or mitigation of loss due to security incidents, and 3) R, or the time required to respond to and recover from security incidents. It is required to enhance P and M and reduce D.

Toshiba Group regards all information, such as personal data, customer information, management information, technical and production information handled during the course of business activities, as its important assets and adopts a policy to manage all corporate information as confidential information and to ensure that the information is not inappropriately disclosed, leaked or used. In view of this, Toshiba has a fundamental policy “to manage and protect such information assets properly, with top priority on compliance.” The policy is stipulated in the chapter “Corporate Information and Company Assets” of the Standards of Conduct for Toshiba Group, and managerial and employee awareness on the same is encouraged.
In response to regulatory changes and changes in the social environment, Toshiba Group revises the related rules on an ongoing basis so as to rigorously manage its information security.
When providing personal information and confidential information to outsourcing contractors, we request them to maintain confidentiality and comply with relevant laws and regulations in the same manner as Toshiba does, and to implement thorough training for employees handling the information.
We include in the contract terms the possibility of terminating contract and seeking damages in case of violations of confidentiality obligations or personal information protection obligations as stipulated in the contract.

• Standards of Conduct for Toshiba Group 17. Information Security
• Privacy Policy

Addressing information security as a management priority, Toshiba Group appointed the Chief Information Security Officer (CISO) and each corporate staff division and Toshiba Group company has established, under the supervision of the CISO, an information security management structure.
The Cyber Security Committee deliberates matters that are necessary to ensure information security throughout Toshiba Group. The CISO formulates and enacts measures in order to make sure that internal rules related to information security are enforced in a problem-free, effective, and definitive manner.
At each division inside Toshiba, key Group companies, and subsidiaries and affiliates^*1, the head of the organization serves as Information Security Management Executive, bearing responsibility for information security at their respective organization. The Executives provide guidance and assistance to Group companies in Japan and overseas under their control to ensure that they implement information security at a level equivalent to that of Toshiba.

• Key Group companies and Toshiba Elevator and Building Systems Corporation, Toshiba Lighting & Technology Corporation, and Toshiba Plant Systems & Services Corporation
• CSIRT: Computer Security Incident Response Team

• EDR：Endpoint Detection and Response

To protect against cyber-attacks, which are becoming more sophisticated with every passing year, we introduced a function to block suspicious e-mails, enhanced our anti-virus measures for information equipment such as IoT devices, and trained all employees in handling targeted attack e-mails. We also utilize external threat intelligence to understand terminal vulnerabilities and prevent attacks before they occur. Additionally, our Security Operation Center (SOC) and CSIRT have established documented procedures for monitoring and incident response.

The expansion of cloud services and remote work has also increased the number of potential targets for cyberattacks. We are working to strengthen internal and external countermeasures, including by collecting and analyzing information on servers and network devices available on the internet, introducing mechanisms to understand vulnerabilities and configuration errors, and using attack simulation tools to assess the risk of security products introduced by the Company.

Under our information security management structure, we annually verify that all internal systems, such as systems that manage customer data, are being operated in accordance with the rules, including setting of access privileges and implementation of vulnerability countermeasures. To ensure that our most critical information is comprehensively protected, we maintain a database of the storage locations and management status for all data classified as “Top Secret” and “Confidential.”  

Toshiba Group covers a diverse portfolio of businesses. To ensure Group-wide information security, it is vital for each Group company to rotate the PDCA (Plan-Do-Check-Act) cycle independently. Accordingly, Toshiba Group carries out an annual self-audit of its compliance with internal rules to identify issues and plan improvements. The Corporate Technology Planning Division evaluates the results of the audits and related improvements carried out by each Toshiba division, key Group companies, and subsidiaries and affiliates^*1, and provides support and guidance where necessary. 

In FY2024, the following key points were identified: (1) ID/password management, (2) reduction and organization of company information and management of external storage media, (3) security management at Group companies, and (4) manufacturing system security. In addition, with regard to key point (4), with ransomware countermeasures in mind, we confirmed the EDR (Endpoint Detection and Response) implementation status for devices connected to the Toshiba network and the status of virus scans for USB storage media. We confirmed that, overall, security was being maintained and managed effectively, and we reported these results to the Toshiba CISO. We will continue to review and advance our fundamental initiatives.  
Toshiba Group companies in Japan have obtained ISMS certification^*2 and PrivacyMark certification^*3 according to their business areas, and have undergone external audits by ISMS certification bodies and the Japan Institute for Promotion of Digital Economy and Community (JIPDEC). ISMS certification has been obtained by 14 business divisions of Toshiba Group companies in Japan, including Toshiba Corporation. The PrivacyMark has also been obtained by 14 Toshiba Group companies in Japan, including Toshiba Corporation.

Moreover, Toshiba Group conducts yearly training for all officers, as well as permanent and temporary employees, in order to enforce strict compliance with in-house regulations. There are also programs about information security such as basic training, and introductory training for new graduate employees.

• key Group companies, and subsidiaries and affiliates Key Group companies and Toshiba Elevator and Building Systems Corporation, Toshiba Lighting & Technology Corporation, and Toshiba Plant Systems & Services Corporation
• ISMS certification  A third-party certification system for the information security management system compliant with ISO/IEC 27000 series
• PrivacyMark certification A certification mark granted through third party assessment to businesses that have a system to ensure appropriate handling of personal information in compliance with Japan Industrial Standards (JIS) Q 15001: Personal Information Protection Management System–Requirements

*Toshiba Infrastructure Systems & Solutions Corporation has been integrated into Toshiba Corporation on April 1, 2025.

In the event an information security incident such as the leakage of confidential information, Toshiba responds promptly in accordance with the Information Security Incident Reporting Structure.
When an employee becomes aware of an incident or potential incident involving the leakage of corporate information, the employee immediately reports to the CSIRT. In response, the CSIRT Leader devises necessary measures, such as an investigation into the cause and review of actions to prevent recurrence. In the event of a serious leakage or potential leakage of confidential information that may constitute a violation of laws and ordinances, Toshiba implements measures such as disclosure following discussion among the related corporate staff divisions in accordance with the applicable laws and ordinances.

• Key Group companies and Toshiba Elevator and Building Systems Corporation, Toshiba Lighting & Technology Corporation, and Toshiba Plant Systems & Services Corporation

• Suggestions and Inquiries about Toshiba's Cyber Security

In FY2024, there were no leaks of important information held by Toshiba Group.
There were also no personal data-related complaints or appeals filed by regulatory authorities or other external parties. We will continue to take every precaution to prevent incidents related to information security.
For details on information security management, please refer to our Cyber Security Report.

Toshiba Group has formulated the "Toshiba Group Privacy Statement" as a declaration of its management stance on the use of privacy information across its data service businesses, towards promoting the trust of society and the realization of a trusted data society.
As digital transformation (DX) becomes a global trend, we are strengthening privacy governance, at that same time as we seek to make full use of the power of data to create valuable products and services.
Toshiba Group positions respect for privacy as part of respect for human rights.

• Standards of Conduct for Toshiba Group　1. Human rights
• Respect for Human Rights

When selecting suppliers and business partners, we evaluate their ability to manage data appropriately. If contracts involve data sharing, we require specific information security management measures and conduct compliance audits as necessary.

We also hold regular cyber security seminars for our suppliers and business partners. We communicate the matters described in the Toshiba Group Cyber Security Policy and Guidelines and demand stronger security response capabilities. In addition, we have established a contact point for security-related consultations, and both Toshiba and our suppliers and business partners are working to improve their security levels.

These security and privacy policies are published externally as the Standards of Conduct for Toshiba Group and the Privacy Policy, and any changes are immediately posted on our website. When Toshiba Group rules and policies change, we provide explanations and notices within the Toshiba Group and update each company's rules and policies accordingly.

See below for details of cyber resilience and information security initiatives.

• Cyber Security
• Cyber Security Report
• Toshiba Group privacy Statement
• Toshiba AI Governance Statement
• Toshiba AI
• Toshiba AI Governance