Japan's NCO advisory and your vendor reviews

On 9 October, Japan's National Cybersecurity Office (NCO) published guidance for organizations that hold large volumes of personal or sensitive data. It followed a series of data leaks at organizations in Japan, which JPCERT/CC dates to around September. Other agencies issued related notices in the same week, including the FSA, METI, MIC, the IPA, the National Police Agency, the Personal Information Protection Commission, NICT and JPCERT/CC, and the NCO collected them on one page on 14 October.

The guidance covers three areas: web systems, the supply chain and data management. The supply-chain section is the one third-party risk teams will want to read twice.

What the NCO asks for

The NCO's starting point is simple. Security can't stop at your own systems. Attackers sometimes get in through a contractor with weaker defenses and then reach the organization they were really after, so the NCO asks companies to manage security "together with" their contractors.

In practice, the advisory lists four groups of measures:

Know how your contractors manage security. Confirm their security policy, organization and division of responsibilities. Check how they handle personal and business data on a regular basis. Look at certifications and audit results. Understand how their subcontractors are managed. And check continuously, not only when the contract is signed.
Put security requirements in the contract. Define how information is handled, require access and log management, write in a duty to report unauthorized access or leaks, and agree how you will work together during an incident.
Share only what's needed. Give contractors the minimum personal and business data the work requires, make sure it's deleted when the work ends, and manage the access you grant them.
Manage risk across the whole supply chain. Identify your important suppliers and contractors, map how information flows through the supply chain, understand your critical dependencies, and assess risk regularly.

The FSA separately asked financial institutions to review their cybersecurity measures, including third-party risk management and incident response. And the NCO closes with a line aimed at leadership: cyber damage is "no longer just a problem for the IT department." It asks executives to treat cybersecurity as a management issue.

Why "continuously" is the important word

Most of these measures will look familiar to anyone who runs a vendor risk program. What stands out is the expectation that checks happen on an ongoing basis, across subcontractors as well as direct vendors, and through to the end of the work.

The technical picture explains why. JPCERT/CC's alert describes attackers scanning for known vulnerabilities, abusing APIs, and using API keys stolen from other systems. Its follow-up research on 15 October found that the attackers used AI to scan for known flaws and attack services through their APIs, analyzed Android apps to find the APIs behind them, and targeted services outside Japan as well. NICT published a separate notice on the same app-to-backend technique on 13 October. A vendor's exposure can change between one annual questionnaire and the next.

That's where many programs feel the strain. If every vendor review is a long, manual cycle, "continuously" turns into a choice between two poor options: hold back the new tools the business wants, including AI tools, or review more vendors less carefully. Neither is what the NCO is asking for.

Making it practical

Teams that handle this well tend to treat vendor review as an ongoing process sized to each vendor, rather than a one-off project that every vendor gets in the same form.

Start from the data and the access. The NCO's "share only what's needed" measure doubles as a way to set review depth. A vendor holding customer personal data or credentials to your systems gets a deep look. A tool with no sensitive data and no connections gets a light path. Low-risk requests aren't held up, and attention goes where it counts.
Map one hop out. Ask which subcontractors, platforms and service providers sit behind each important vendor. The NCO names subcontractors explicitly and notes that attackers sometimes use a contractor as a foothold. We looked at the same pattern from another angle in Your vendor patched. Their MSP didn't.
Watch between reviews. Pair the periodic assessment with signals that tell you when something has changed: a newly exploited vulnerability in a product a vendor runs, an exposed service, a disclosed incident. That way the next review is triggered by risk, not by the calendar.
Write the contract for the incident you hope never happens. Breach-reporting duties, clear roles during an incident and confirmed deletion at the end of the work are easy to agree up front and much harder to add later.
Close the loop at offboarding. Deletion and access removal when the work ends is its own control, and it's often the one nobody owns. We wrote about that gap in The vendor left. Your data didn't.

None of this asks people to step out of the decision. Risk owners still approve the calls that matter. The aim is to give them current, accurate information about each vendor, so that saying "yes, safely" to a new partner or AI tool is the normal outcome rather than the exception.

A good moment to start

The NCO advisory gives security, procurement and business leaders in Japan a shared checklist and a shared vocabulary. For teams that already run a vendor risk program, it's a chance to move from point-in-time questionnaires to continuous, risk-based review. For teams that don't yet, the four groups of measures above are a solid place to begin.

If your team is working through the NCO checklist and wants to compare notes on how to run vendor reviews that keep pace with the business and stay accurate, we'd be glad to talk: rescana.com/#contact

Japan's NCO advisory puts vendor management on the leadership agenda. Here's how to keep up with it.

What the NCO asks for

Why "continuously" is the important word

Making it practical

A good moment to start

Further reading

Sources

Recent Posts