Policy and Basic Approach
Information security
Sanrio conducts business activities by utilizing customer information, business partner information, information created by the Company itself, and other information. We recognize that it is our responsibility as a business enterprise to protect this information and the information systems that handle it from various threats so that our customers can use our products and services with peace of mind.
Protection of personal information
Sanrio enforces the Sanrio Personal Protection Policy and strives to ensure the appropriate handling of personal information. Overseas Group companies comply with applicable local privacy laws; in the European Union, policies and enforcement systems have been established based on the EU General Data Protection Regulation (GDPR), and in the United States, a personal information handling policy and enforcement system have been established based on the California Consumer Privacy Act (CCPA).
We have also established a system to ensure compliance with the laws and regulations applicable to our digital business in each region. After consulting with a law firm to identify relevant issues, an external third-party organization assesses the operational systems and system configurations of the Company and its outsourcing partners. Information security measures are reinforced through compliance with applicable laws in Japan and overseas.
Structure and governance
Information security system
Sanrio has established rules on information management and on information security. The managing executive officer of the Corporate Strategy Division serves as the general manager and the DX Department in the Corporate Strategy Division serves as the control department in charge of information security for the entire company. We also appoint individuals responsible for promoting and overseeing these initiatives in each internal department and implement measures based on the annual plans we have developed. We also determine how to address company-wide risks and take corrective action as necessary.
Main initiatives
Information security initiatives
To ensure that information security measures are thoroughly implemented, Sanrio requires employees to take e-learning courses multiple times a year and offers voluntary information security training sessions three times a year. In addition, targeted attack e-mail tests are conducted several times a year. A security assessment of the entire Sanrio Group, including overseas subsidiaries, is also being conducted by an external specialist organization. Based on the results of these initiatives, we have formulated a global security policy and continue to implement improvement measures at each Group company. We intend to strengthen governance and further improve information security across the Group through regular audits conducted by an independent third party.
Strengthening the information security system
Sanrio has both deployed a security monitoring platform that performs integrated analysis of logs collected from the various devices within our network systems and contracted with an external specialist organization for Security Operation Center (SOC) services, and is performing monitoring 24 hours a day, 365 days a year. This enables early detection of and rapid response to threats such as unauthorized access and malware infections, thereby advancing our information security measures even further.
Labeling system operation
Sanrio has begun operating an information labeling system and is migrating information assets to the cloud. We are improving our information management system and overall security level with consideration also given to business continuity planning (BCP). We are also strengthening access rights management for information assets and reducing the risks of unauthorized access and information leakage by implementing appropriate access controls and regular reviews of access rights.