Information Security Report 2010 - Nec

NEC’s Initiatives to Build a Secure IT-Driven Society
Information Security Governance
Under the “One NEC” concept, the NEC Group is promoting information security
together with Group management while strengthening governance to maintain
and enhance the level of information security across the entire Group.
Approach to Information Security Governance
At the NEC Group, management systems have been built
at the individual business-unit or each group company.
And each organization is required to maintain and
enhance its information security based on a PDCA cycle.
We believe it is important that each of these
activities be implemented efficiently and effectively as
“One NEC” while ensuring effective governance to
enhance security levels across the Group. Specifically,
NEC defines goals of information security levels in the
Group and provides all organizations with the direction
■ Information Security Governance
of principles on effective measures across
the Group and on the allocation of business
Information Security Governance
resources to achieve the goals. We also
monitor and evaluate the status of information
security including all incidents in the
Direct Monitor Evaluate Report
Group. Then we provide the organization with
a guidance as necessary and make improvements
from results of the evaluation.
Plan
Do
Check
Act
NEC discloses the information on these
(Establish systems) (Initiate and (Inspect and review) (Maintain and
implement policies)
enhance systems) activities through our Annual CSR Report and
this Information Security Report to fulfill our
Management Systems Within Each Organization
accountability to stakeholders.
Overall Information Security System Integrated with Group Management
The Information Security Strategy Committee, chaired by a managers, with primary responsibility for information security
in their divisions including at group companies under
senior executive vice president, promotes the NEC
Group’s Information Security Governance. It has three their jurisdiction. They designate management promotion
promotion committees for domestic and overseas subsidiaries
and suppliers. These committees are responsible for dissemination of rules within their organizations, and are
staff from among their managerial ranks, ensure thorough
explaining various measures, sharing information about responsible for the implementation and execution of security
measures. They review the status of execution and do
incidents, and informing directions. The business division
heads in each organization act as information security necessary improvement. The NEC division with overall
responsibility for information security also works
■ Information Security Promotion Structure closely with related head office staff divisions to
President
move the concrete development of each measure
forward.
Information Security Strategy
Business
Committee
Strategy
(Chaired by senior executive
In fiscal 2010, we established the NEC
Committee
establishes group policies, etc.)
Group Management Policy, which is designed
Information Security Promotion
Division to achieve a global standard management foundation.
And the Group moved ahead to stan-
Committee
Responsible for
(Plans promotions, ensures implementation,
makes requests, etc.)
Information
Domestic Overseas Promotion Security and
Corporate
Promotion Promotion Among Suppliers
dardize rules regarding the performance of
Head Office Staff
Auditing
Bureau
Divisions business and to unify systems, business processes,
and infrastructure.
NEC Business Divisions
Group Companies
(domestic and overseas)
Internal Audits
Information Security Manager and Promotion Manager
(Responsible for implementing measures, inspecting status,
making improvements, etc, within each organization)
NEC CORPORATION
Information Security Report 2010 03