BUSINESS PROTECTION
While personal security protects your own accounts, organizational security is about building a system that protects customer data, employees' work, and public trust. This guide organizes measures into seven areas, from board-level decisions to daily operations, following NIST CSF 2.0 and Japan's Cybersecurity Management Guideline by MIC and IPA.
Security is not just an IT-department issue. Boards recognizing risk and assigning responsibility and budget is the foundation of everything else.
Japan's Cybersecurity Management Guideline (MIC & IPA) assumes that management recognizes risks, builds a structure, and implements and reviews countermeasures. Start by deciding a security policy, securing budget, and appointing a responsible officer.
A written policy also becomes the basis for informing employees, setting expectations with vendors, and explaining yourself if an incident goes public.
The U.S. NIST Cybersecurity Framework 2.0 organizes measures into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. The 2024 revision added Govern as the leading function because board-level involvement is the starting point.
It works well as a map for discussing which functions your organization is weak in.
Implementing everything at once is unrealistic. CIS Controls and CISA's Cross-Sector Cybersecurity Performance Goals (CPGs) list high-value basics first: asset inventory, MFA, log management, and so on.
For small and mid-size organizations, reaching the CPGs' essential items is a realistic first goal.
CIS — Critical Security Controls ↗CISA — Cross-Sector Cybersecurity Performance Goals ↗
Assuming breaches cannot be fully prevented, how to absorb the financial impact (investigation, restoration, compensation, business interruption) is also a management decision.
Cyber insurance requirements (MFA, backups, vulnerability management) themselves work as a security checklist.
Targeted phishing and business email compromise enter through people. Harden this entry with both process and awareness.
Go beyond annual e-learning: run periodic simulated phishing campaigns and track click rates and report rates.
Removing the stigma around reporting ("I clicked something odd") directly improves early detection. Make it explicit that reporters are never blamed.
Lingering accounts and access rights of former employees are a classic cause of breaches and insider incidents.
Build granting and revocation of permissions into HR processes at hiring, transfer, and departure, and automate where possible.
Customer data flowing into personally adopted SaaS or free tools becomes an unmanaged leak path.
Inventory the cloud services in use and establish approval rules and usage policies — including careless pasting of sensitive data into free translation or chat tools.
Application vulnerabilities are inevitable, so build a structure where a leaked password alone never grants entry.
Apply MFA to every externally reachable entry point: corporate email, VPN, cloud admin consoles. Authenticator apps and FIDO2/passkeys are safer than SMS codes.
As the October 2026 emergency PHP release (CVE-2026-109618/109619) showed, critical flaws in application layers must be assumed — layered authentication is the most cost-effective way to limit damage.
If everyone has local admin rights on their PC, malware infections cause far more damage. Day-to-day work should run with standard rights.
Separate server and cloud administrator accounts from daily accounts, and aim for just-in-time elevation (PAM).
The more SaaS you use, the easier it is to miss removing an account when someone leaves.
Centralize accounts on an IdP so adding and removing users completes in one place. The goal is zero orphan accounts.
Know your assets, close the holes, and build structures that contain intrusions and allow recovery.
Inventory the OSes, middleware, and libraries in use, and establish a cycle of reviewing advisories (CVE, JVN) and applying fixes. Being able to answer "what versions do we run?" is the starting point.
The October 21, 2026 emergency PHP release exposed that environments on end-of-life versions have no fix — only mitigations. Plan the retirement of unsupported stacks.
EDR (Endpoint Detection and Response) on endpoints and servers enables early detection and scoping of intrusions.
Assigning owners who watch and triage alerts is a prerequisite — tools alone are not a control.
Drop the assumption that the internal network is trustworthy; verify identity and device posture on every access.
Narrow paths to critical systems so a single compromise cannot spread laterally. Segmentation can be phased in even by small organizations.
Recovery from ransomware requires backups attackers cannot destroy: three copies, two different media, one off-site or offline.
A backup only counts when it can be restored — include periodic restore tests in operations.
Data you don't hold cannot leak. Minimize retention, protect what remains, and prepare for mandatory reporting.
Inventory customer, HR, and confidential records, and define minimal retention periods and access rights. Knowing each asset's location, sensitivity, and owner is the foundation of data protection.
Also review deletion deadlines for former customers' data and stop collecting items beyond the stated purpose.
Since April 1, 2025, Japan's Act on the Protection of Personal Information obliges businesses to report qualifying data breaches to the Personal Information Protection Commission and to notify affected individuals, with penalties for violations.
Prepare the judgment criteria, deadlines, required items, and record templates in advance so the first hours of an incident are not spent figuring out the rules.
Combine encryption at rest and in transit with access control that limits databases and file servers to those who need them.
Logs of who accessed what and when support both incident investigation and breach-reporting decisions; retain them with tamper protection.
Even a well-defended company can be breached through vendors. Use contracts and continuous checks to fence them in.
Use contracts to require and verify vendors' and subcontractors' security: scope of data handling, access rights, breach notification duty and deadlines, and audit rights.
Requiring prior approval for subcontracting prevents arrangements that drift from what you assessed.
Review vendor security not just at onboarding but on a regular cadence. In Japan, large breaches via printing and mailing vendors (e.g., the 2024 Iseto case, ~1.5 million records) have repeatedly put the contracting party's responsibility in question.
The more sensitive the data entrusted, the deeper and more frequent the assessment.
Breach damage cannot be reduced to zero. Speed from detection to reporting, recovery, and disclosure determines the loss.
Decide in advance who isolates systems, who investigates, and who talks to management, legal, and regulators.
Even without a standing CSIRT, a role assignment and contact list on a card dramatically speeds up small organizations' first response.
List the likely reporting destinations (the Personal Information Protection Commission, industry regulators, JPCERT/CC, police cybercrime units, customers) and what each requires.
Obligations and deadlines differ by incident type: personal data breach, ransomware, targeted attack.
Once a year or so, run tabletop exercises with realistic scenarios: ransomware infection, misdirected email, a vendor's breach notification.
Other companies' disclosed incidents make excellent scenario material. Reading how similar organizations handled detection, disclosure, and causes is a practical start.
The core ideas — layered authentication, updates, least privilege — are the same, but what's protected and the scale of responsibility differ. Here is how this guide maps to the personal guide.
| Aspect | Personal | Business / organization |
|---|---|---|
| What is protected | Your own accounts, devices, money, privacy | Customer and employee data, business systems, public trust |
| Main entry points | Your email account, reused passwords | Every employee's accounts, internet-facing systems, vendors and supply chain |
| Authentication | Password manager + MFA | Org-wide SSO + mandatory MFA, separated and centralized privileged accounts |
| Updates & patching | Turn on auto-update on devices and apps | Asset inventory → impact assessment → planned, tested rollout; end-of-life management |
| Blast radius | Financial loss, impersonation, account takeover | Harm to customers, statutory reporting, business interruption, loss of trust |
| After it happens | Contact the service and your bank; change passwords | Response team activation, regulator reporting, disclosure and apology, recurrence prevention |
Personal security can work through one person's effort. Organizational security only functions when three layers align: policy (rules), technology (systems), and people (training).
Organizational security is never finished — it is a cycle of review as threats change. For your own and your family's protection, see the personal protection guide. To see what actually happens, browse the breach records on Leak Watch.
Written & reviewed
Reviewed byYutaro SasaoFounder & CEO, MediaLeap Inc.
CEO of MediaLeap Inc. Working on both sides of web advertising and web media since 2013; founded the company in May 2025.
Review scope: cross-checking against primary sources (official and government announcements), verifying claims stay within the facts, and checking source attribution。Last reviewed:
Written by:Leak Watch editorial team (AI-assisted drafts verified against sources by the editorial team) · Reviewer profile · Request a correction