Risk management
Approach to risk
The business environment surrounding our group remains highly uncertain due to rising geopolitical risks and changes in economic and social structures. In particular, the escalating tensions in the Middle East and changes in the situation surrounding maritime transport, including the Strait of Hormuz, could affect crude oil procurement, logistics, supply chains, and energy prices, posing a significant management risk for our company, which primarily operates in the petroleum industry. Furthermore, the risks surrounding our business are becoming more diverse and complex due to responses to climate change, regulatory trends, and advancements in technological innovation. In this environment, we have introduced Enterprise Risk Management (ERM) to address the identification, assessment, and management of risks from a company-wide perspective.
Governance
Strategy
Enterprise Risk Management (ERM)
Our comprehensive risk management (ERM) is carried out through appropriate communication between Enterprise Risk Management Committee and Risk Management and Compliance Committee. Based on discussions by management, we categorize risks and issues that require immediate response and company-wide risks that require a company-wide response, and check the status of these responses. In this way, we practice comprehensive risk management that combines responses to risks and issues with company-wide risk management activities.
Risk management
Enterprise Recycling Management (ERM) Activities
Based on our Enterprise Risk Management (ERM) framework, we identify risks from a company-wide perspective, organize anticipated events and impacts into risk scenarios, and evaluate them from the perspectives of impact and probability. Based on this, we select material risks that management prioritizes addressing and monitoring. For these selected material risks, we continuously monitor the implementation status of countermeasures and changes in the risk environment, and revise our response policies as needed. Furthermore, these efforts are operated based on the PDCA cycle, and we continuously revise risk scenarios and update risk assessments in light of changes in the business environment, thereby striving to enhance our company-wide risk management.
● Image of selecting material risks
●Comprehensive risk management activities
●Comprehensive risk management activity cycle
Further strengthening crisis response capabilities
Responding in times of crisis
In our "Crisis Response Regulations" (approved by the president), the Group has established response policies, how to interpret the level of a crisis, communication systems, the establishment of a response headquarters, etc. In the event of a crisis, we will strive to minimize the social impact and damage by taking prompt and appropriate initial measures and responding organizationally with a clear chain of command.
Policy on crisis response (excerpt from Rules on how to deal with a crisis)
(1) Place top priority on safety of all people.
(2) Minimize environmental impact
(3) Sincerely deal with a crisis all the time from the viewpoint of ordinary citizens.
(4) Quickly disclose accurate information.
(5) Retain Company s reliability by carrying out (1) through (4)
●Crisis level
|
|
|
|
|---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
●Communication system
Business Continuity Plan (BCP) initiatives
The Group has formulated BCPs for a Tokyo Metropolitan Earthquake, a Nankai Trough Massive Earthquake, and a new strain of influenza. Comprehensive disaster drills based on each BCP are conducted every year, and cooperation with each base is checked, issues are identified, and the feedback is reflected in revisions to the BCP. At Refineries/Complexes, factories, etc., disaster drills are conducted periodically at all bases based on various crisis response regulations.
In addition, after being designated as a designated public institution by the Cabinet Office in fiscal 2015, we submitted the latest version of our Disaster Prevention Operation Plan in December 2019. As a designated public institution, we are currently proceeding with the emergency vehicle registration of tank trucks in each prefecture.
Implementation of comprehensive disaster prevention training
Comprehensive disaster prevention training (September 2024)
In order to improve the effectiveness of our BCP, we have been conducting comprehensive disaster prevention drills every year since 2007, and the 2024 fiscal year will mark the 18th time the drill has been held.
Based on a scenario that assumes a massive earthquake in the Nankai Trough and a large-scale power outage in the Chubu region, and assuming that the Japan Meteorological Agency issues a "Nankai Trough Earthquake Emergency Information (Massive Earthquake Alert)," we confirmed how to respond to a complex disaster. 193 participants from the head office (Disaster Management Headquarters), related branches, and manufacturing bases participated in the training, including information gathering, transmission, and response planning. In addition, the training was divided into two parts, including a scenario of a delayed earthquake (on the west side) occurring three days after the earthquake, and we confirmed the response status under complex assumptions. At the same time, a company-wide safety confirmation training was also conducted, and approximately 8,500 employees, including those from group companies, promptly reported their safety. We are reflecting the issues and realizations gained from the training in our BCP to improve our crisis response capabilities.
Response to economic security
Our group is closely monitoring the economic security implications of rising geopolitical risks and intensifying international competition, and is taking necessary preparations and responses. As part of this, we are conducting training in all relevant departments, simulating various geopolitical risk incidents occurring overseas, and raising awareness among stakeholders by formulating comprehensive response measures, including ensuring the safety of people, protecting assets, and maintaining information and communication. Furthermore, as a key infrastructure operator, we are strengthening cybersecurity measures and improving system defenses to ensure a stable energy supply, while also strengthening cooperation with relevant government ministries and agencies to balance legal compliance with maintaining corporate value. We are also strengthening risk investigations and responses within the company and throughout the supply chain, and are advancing internal improvements regarding diversification of suppliers for essential raw materials, export controls, and technology transfer. In order to balance business sustainability and international competitiveness, our group will continue to monitor policy trends and international affairs, and contribute to economic security by implementing flexible and prompt risk management responses.
Information management/security management
Basic approach
Under our "Basic Information Security Policy," our group strives to maintain and improve customer services by ensuring the confidentiality of information assets and the availability and integrity of information systems and networks, while utilizing information technology. Customer information is collected and used appropriately in accordance with our "Customer Information Management Standards," stored securely and up-to-date, and disposed of appropriately.
Furthermore, in order to mitigate the impact of increasingly sophisticated cyberattacks, we have implemented a multi-layered system of defenses to prevent unauthorized intrusion and the removal of important information. We also conduct annual e-learning sessions on information security for all IT system users to ensure thorough information management.
Policy
Basic policy on information security
1. The Idemitsu Group will ensure the confidentiality of its information assets and the availability and integrity of its information systems and networks, and will strive to maintain and improve customer services using information technology.
2. We will take appropriate protective measures to safeguard customer and business partner information from leakage, alteration, and destruction. In the event of an abnormality in our information systems, we will promptly restore them, investigate the cause, and take corrective action.
3. We will ensure the availability, integrity, and confidentiality of information systems and networks, and strive to avoid causing inconvenience to our customers, business partners, and other stakeholders. In particular, for systems related to control systems, we will ensure safe operation, stable operation, and quality by implementing appropriate protective measures, maintaining monitoring systems, and continuously performing appropriate maintenance work.
4. We will ensure that our employees, temporary staff, and external contractors recognize the importance of information security through education and awareness-raising activities, and that they use information and information systems appropriately.
5. The Idemitsu Group will conduct regular audits to check and evaluate compliance with security policies and strive to ensure security.
Governance
Information management/security management promotion system
Our group operates under the "Information Management Guidelines," with the General Affairs Department's Risk Management Section, the responsible department, overseeing information management across the entire group. In the event of a serious security incident, the crisis level will be determined as described in the "Crisis Response Regulations," and the response headquarters will take the lead in taking appropriate action. Furthermore, with the aim of maintaining and improving the security of control systems, we have established a Control System Security Council and are promoting security measures systematically and planned throughout the group based on the "Control System Security Guidelines."
Additionally, with the aim of maintaining and improving the security of control systems, we have established a security council and are promoting security measures across the group in an organized and planned manner based on the "Control System Security Guidelines." At our manufacturing sites, we use the PDCA cycle to make continuous improvements and conduct incident response training every year. We also provide control system e-learning for system users and administrators.
●Overall picture of the information management and security management promotion system
The Ping Dynasty System
Under normal circumstances, Digital ＆ ICT Department takes the lead in monitoring the management status of the entire group of companies, and immediately initiates and responds to any anomalies detected.
Emergency response system
Based on the scale and scope of the cyber incident, three crisis levels will be established according to the aforementioned regulations, and a response headquarters will be set up. Headquarters and Complex will cooperate to make rapid decisions and take action. After recovery is complete, the response headquarters will take the lead, working with Digital ＆ ICT Department to extract lessons learned from the incident and implement a PDCA cycle by disseminating these lessons throughout the group.
Strategy
Based on the peacetime and emergency systems we have established, the new medium-term plan's strategy will further develop our previous efforts. As cyberattacks have become increasingly sophisticated and complex in recent years, it is difficult to completely defend against them. Therefore, in addition to preventing intrusions, we will make "limiting cyber damage," which assumes cyberattacks will occur, a core theme, and aim to establish "resilience" that will allow us to continue operations even if attacked, and to recover quickly if operations are interrupted.
Based on the NIST CSF* framework, we will promote a strategy comprised of four capabilities. We will strengthen "resistance" by transforming our traditional multi-layered defenses into a zero-trust system. We will enhance "predictive capabilities" by improving peacetime SOC monitoring and log management with AI and other technologies. We will improve "adaptability" by reliably conducting annual e-learning and targeted training. We will ensure "recovery capabilities" by establishing a BCP, including a response system for emergencies.
* The Cybersecurity Framework of the U.S. National Institute of Standards and Technology
|
|
|
|
|---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Initiatives
Number of serious information security breaches in fiscal year 2025: 0
In-house training
Human resource development
ICT including security planning, implementation, and operation * After defining a CDP (career development plan) for human resources, we evaluate the skills and set goals for each individual in the ICT department, and develop human resources in a planned manner.
-
ICT (Information and Communication Technology)
e-learning on information security
We conduct annual e-learning sessions on information security (in Japanese, English, Chinese, Korean, and Vietnamese) for all IT system users (employees, temporary staff, external contractors, etc.) with the aim of teaching them the rules they must follow.
Control Systems e-Learning
Since fiscal year 2019, we have been conducting e-learning courses on control systems for users and administrators of control systems.
|
|
|
|
|
|---|---|---|---|
|
|
Attendance rate: 100% |
Attendance rate: 100% |
Attendance rate: 100% |
|
|
Attendance rate: 100% |
Attendance rate: 100% |
Attendance rate: 100% |
*The number of people varies from year to year due to changes in the number of eligible individuals (number of employees).
e-learning for web managers
Since fiscal year 2023, we have been conducting e-learning for web administrators, targeting those responsible for website and system management. In fiscal year 2025, due to changes in regulations, 151 web administrators participated in the course.
Security training for DX personnel
Starting in fiscal year 2024, in order to promote the improvement of DX literacy among all employees, we have made a basic cybersecurity education program available so that participants can learn the overview and key points of cybersecurity.
Email training
To mitigate and raise awareness of the risks of malware infection from targeted attack emails, we conduct targeted attack email training quarterly for our company and group companies (including overseas). During the training, we check not only the open rate but also the reporting status of suspicious emails, and provide additional training as needed.
Awareness email
We regularly send out an awareness email, "Cybersecurity Letter," containing the latest information on cyberattacks and other important information security points.
Implementation of education and training based on the assumption of cybersecurity incidents and accidents.
In addition to training programs planned internally, we participate annually in the interdisciplinary exercise (formerly known as the cross-sectoral exercise) organized by the National Cyber Security Center as part of our cyberattack response training.
Strengthening security measures
Advanced countermeasures
To address the increasing risk of cyberattacks, including ransomware attacks, we are promoting system-based countermeasures such as strengthening user authentication functions and improving defense systems. We are also focusing on developing specialized personnel to prepare for increasingly sophisticated cybercrimes.
Conducting a vulnerability assessment
Our company regularly conducts security vulnerability assessments by third parties. Based on the assessment results, we create improvement plans and implement countermeasures systematically.
Strengthening Cyber Resilience
While implementing measures to prevent intrusions, we have also established a system to quickly detect, analyze, and contain any incidents that may occur, minimizing the impact on our business, and we are taking appropriate measures accordingly.
Privacy protection
Basic approach
Regarding the handling of personal information including specific personal information *1 and anonymously processed information *2 (hereinafter referred to as "personal information, etc."), our group complies with the "Basic Policy on the Protection of Personal Information, etc." (approved by the president) and handles it. We will manage all personal information more safely and appropriately.
-
Individual number and other personal information that includes the individual number
-
Information about an individual obtained by processing personal information so that a specific individual cannot be identified, and the personal information cannot be recovered.
Policy
Basic policy on protection of personal information, etc.
1. Compliance with Laws and Regulations
The Group will comply with the Act on the Protection of Personal Information, the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures, other applicable laws, related government and ministry ordinances, guidelines, etc.
2. Matters Concerning Acquisition
The Group will acquire Personal Information, etc. by lawful and fair means. Unless otherwise permitted by applicable laws, the Group will either explicitly explain or announce the purpose of use of Personal Information, etc. to the person in advance, or give notice or announce to the person immediately after acquisition thereof. In addition, the Group will, when acquiring special care-required personal information, obtain the prior consent of the person, unless otherwise permitted by applicable laws.
3. Matters Concerning Use
The Group will use the Personal Information, etc. only within the scope necessary for achieving the purposes of use thereof, unless otherwise permitted by applicable laws.
4. Matters Concerning Provision and Disclosure
Unless otherwise permitted by applicable laws, the Group will not disclose or provide without the consent of the person any Personal Information, etc. to any third party other than outsourcing companies, companies sharing Personal Information, etc., and business successors.
5. Matters Concerning Safety Control Measures
The Group will take the necessary and appropriate safety control measures to prevent unauthorized access to, and loss, destruction, falsification, leakage, etc. of, Personal
Information, etc., and strive to improve personal information protection and management systems on an ongoing basis. The Group will clarify who has the responsibility to protect and manage personal information at each organization and provide the necessary and appropriate education, training and supervision to those employees and outsourcing companies which handle Personal Information, etc.
Furthermore, the Group will keep the Personal Information, etc. accurate and updated. Any Personal Information, etc. with regard to which the purposes of use have been achieved and whose retention period prescribed by applicable laws has expired will immediately be destroyed or eliminated.
In the event of leakage, etc., the Group will immediately take case-by-case correction measures.
6. Matters Concerning Disclosure, etc. of
The Group will respond in accordance with applicable laws to requests for disclosure and correction, etc. (i.e. correction, addition, deletion, suspension of use, elimination, and suspension of provision to a third party), of retained personal data and specific personal information files.
If such data and files are not disclosed or do not exist, the Group will notify the requesting person to that effect.
Governance
Regarding the protection of personal information, the General Affairs Department serves as the secretariat, and information management officers are assigned to each department and group company to promote initiatives. We hold an information management manager meeting every year to provide education within the group.
Initiatives
Number of serious personal information protection violations in fiscal year 2025: 0