Information Security
Language switcher
Basic Approach and Policy
Basic Information Security Policy
Under the Kyosei corporate philosophy of the Canon Group, the Canon Marketing Japan Group (hereinafter, the "Canon MJ Group"), has adopted a vision of becoming "A corporate group dedicated to creating new businesses that drive future growth through the power of people and technologies." Under this vision, we will contribute to building a safe, secure, sustainable society through business activities.
In working to enhance sustainable corporate value through solving social issues through our business activities, the Canon MJ Group understands information security risks, information security risks, including cyberattacks, and regard the appropriate handling of information assets used in business activities as an important business challenge. To put these ideas into practice, we will strive to make continuous improvements further based on the following policies.
1. Compliance with laws, regulations, norms and contractual requirements
The Canon MJ Group will comply with laws, regulations, national guidelines and other norms relating to information security and with contractual security obligations.
2. Establishment, implementation and continuous improvement of the information security management system
The Canon MJ Group will establish, implement and continuously improve its management system supporting business activities to be carried out smoothly that provide value to customers from the perspective of information security.
3. Education on Information Security
The Canon MJ Group will provide information security training to all of its executives and employees and to those engaged in its business who are deemed to need it to make sure that they will have the awareness, knowledge and skills to live up to ethical standards and adapt to changing circumstances regarding the proper ways of handling information assets and that they will behave in accordance with the skillset.
4. Business Continuity Management
The Canon MJ Group will identify and evaluate information security risks that may interrupt the process of its provision of products and services and take effective security measures. It will also develop procedures for recovering from a suspension of business due to disaster or accident and endeavor to manage the continuity of its business.
Established: September 1, 2010
Revised: March 15, 2026
Canon Marketing Japan Inc.
Masachika Adachi, President & Representative Director
Personal Information Protection Policy
Under the Kyosei corporate philosophy of the Canon Group, Canon Marketing Japan Inc. (hereafter, “the Company”) has adopted a vision of becoming "A corporate group dedicated to creating new businesses that drive future growth through the power of people and technologies." Through our business activities, we contribute to building a safe, secure, and sustainable society.
The Company recognizes personal information as an indispensable and important information asset in conducting its business activities, and, as part of its social responsibility, will make every effort to protect personal information and respect the privacy of individuals based on the following policies.
1. Compliance with laws, regulations, and other norms relating to the protection of personal information
The Company will comply with Japan’s Act on the Protection of Personal Information, the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures, guidelines issued by relevant government authorities under these laws, national standards, and other norms established for building a personal information protection management system.
2. Establishment of a personal information protection management system
In the course of our business activities aimed at delivering value to customers, the Company will specify the purposes of use before obtaining personal information, use such information within the scope of those purposes, and take necessary measures to prevent its use beyond the intended purposes. The Company will also establish a personal information protection management system to ensure appropriate outsourcing, provision, disposal, and other handling of personal information.
3. Implementation and continuous improvement of the personal information protection management system
The Company will ensure that this policy and the personal information protection management system are made known to all employees. The Company will implement, audit, and continuously improve the personal information protection management system.
4. Ensuring the accuracy and security of personal information
To ensure the accuracy and security of personal information, the Company will implement reasonable safety measures—covering physical, technical, organizational, and human security—according to the risks associated with the personal information handled, and will endeavor to prevent and rectify unauthorized access to personal information, as well as its loss, destruction, alteration, or leakage.
5. Response to inquiries and complaints
The Company will appropriately and promptly respond to complaints and inquiries regarding the handling of personal information and the personal information protection management system.
Established: April 1, 2002
Revised: March 15, 2026
Canon Marketing Japan Inc.
Masachika Adachi, President & Representative Director
The Company obtained the Privacy Mark certification from the Japan Information Processing Development Corporation (currently the Japan Institute for Promotion of Digital Economy and Community, JIPDEC) in November 2003.
Structure and Systems
Governance and Management Structure
Under the information security governance provided by the management team, every Group company and every department has developed an information security management structure, to properly manage information assets and minimize information security risks.
Governance Structure
Information security initiatives are also closely related to social demands, including demands for compliance, environmental measures, business continuity, and quality control. Therefore, at the Risk and Crisis Management Committee, which is in charge of these social demands, members of our management team take steps to strengthen the Group's information security governance. This committee implements a cycle of determining information security policies, strategies, and others (giving direction) , regularly checking changes in the business environment and risks and the level of target achievements (monitoring), evaluating them (evaluation), and giving new direction as necessary based on the results of the evaluation.
Management Structure
Our management structure is divided into two, one part that supervises the Group's information security and another for each company/department. Under the Group's information security supervision structure, an organization that has the Group's headquarters functions plans, suggests, and drives the Group's common rules and measures, including IT, physical, and human security measures. Under the management structure for each company/department, a department in charge of information security or a departmental management structure is created based on the characteristics of each company or business. At the same time, each organization appoints an information security promoter, who works to instill rules and implement measures.
Operation of Management Systems
We operate groupwide information security and personal information protection management systems to ensure the safety of information and protect ourselves against the risks of information leaks, falsification and other information incidents.
Information Security Management System
Our information security management system consists of the implementation of activities in conformity with ISO/IEC27001. Based on management reviews, the status of organizations, risk assessment results and other circumstances, all departments set goals for information security activities and we implement an information security management system in which everyone participates.
Personal Information Protection Management System
Our personal information protection management system consists of the implementation of activities in conformity with JISQ15001. We use a personal information database management system to implement activities such as the assessment of risks in every process from identification of personal information handled and its collection to its disposal and the management of contractors.
Third-party Certification
The Canon MJ Group has built an information security management system (hereafter, "ISMS") and personal information protection management system (hereafter, "PMS") based on a third-party certification standard (JIS standard), to enable the systems to be introduced uniformly and promptly. To have these initiatives evaluated objectively, we use third-party certification systems such as the ISMS Conformity Assessment Scheme and the PrivacyMark System.
Initiatives
Physical Information Security Measures
Use of ID Cards for Access Control and Print Control
In principle, the Canon MJ Group uses a personal authentication system for access control to each business site. We have also introduced flapper gates and biometric authentication as appropriate according to the security level, among other security measures. In addition, we have introduced security cameras to areas accessed by visitors. ID cards for access control are also used for the personal authentication of printer users and for printing log management, which is possible because we have introduced IC Card Authentication PRO for MEAP ADVANCE and Anyplace Print for MEAP ADVANCE from Canon. Personal authentication of printer users has reduced the frequency of incidents where users forget to take printed copies. Combined with the printing log management, the personal authentication has also proved effective for reducing wasteful printing and information leakage risk.
For IT security measures, please refer to the following.
Training and Awareness-raising
Employee Training for Knowledge Acquisition
| Training program | Description |
|---|---|
| All employee training | As part of risk and crisis management training, e-learning based on practical contents is provided so that employees can make appropriate judgments and take appropriate actions with respect to information security and the protection of personal information. Check tests are also given to confirm the level of understanding of each employee. |
| Initial orientation training | This training is provided to new and mid-career employees to ensure that they understand the Group's approach to information security and acquire basic knowledge on the handling of information assets. |
| New line manager training | This training is provided in the form of classroom lectures. It is aimed at having trainees understand the Group's approach to information security and the roles of departmental managers and to acquire the knowledge needed to handle information assets appropriately in their departments. |
At the Canon MJ Group, we create an information security training plan each year and provide e-learning training to all executives and employees of the Group. Trainees acquire the necessary knowledge through classroom lectures, and check tests are given to measure the extent to which the knowledge has been entrenched among them. Initial orientation training is provided to new employees and mid-career employees as new members of an organization. This training is aimed at raising their awareness of information security, having them acquire basic knowledge on information security, and ensuring that internal rules are observed. We provide rank-specific training. For new line managers, we give lectures so that they will have a firm understanding of line managers' roles in information security.
Affiliation with Information Security Organizations
The Canon MJ Group is affiliated with information security organizations to gain the latest information in a timely manner and to study the different problems associated with the industry in an effort to increase its information security.
| JIPDEC | Japan Information Technology Services Industry Association |
| Japan Users Association of Information Systems | Information Processing Society of Japan |
| Japan Network Security Association | Union of Japanese Scientists and Engineers |
| Council of Anti-Phishing Japan | Nippon CSIRT Association |
| Japan Data Scientist Society | Digital Literacy Council (Japan Deep Learning Association) |
| JAPAN Card Data Security Consortium | Supply-Chain Cybersecurity Consortium |