Cybersecurity Measures for Information Systems and Products

Information, Cybersecurity Policy and Structure

Sysmex is working to strengthen Group-wide security governance by enhancing its information security level. To provide safer and more reliable services to our customers and business partners, we have formulated the Information Security Policy and disclosed the Groupʼs fundamental philosophy and policies.
Furthermore, under the supervision and management of Kensuke Iizuka, Director (Member of the Board), Managing Executive Officer, and Information Security Officer, Sysmex has established the Global Information Security Committee. The committee plays a central role in formulating policies related to Group-wide information security, developing business continuity plans, and addressing day-to-day security issues. By building a Group-wide information security management framework, Sysmex works to protect its information assets from various threats and ensure business continuity.

Information Security Policy

Information and Cybersecurity Initiatives

Sysmex has established the Sysmex Computer Security Incident Response Team (Sysmex-CSIRT) and strengthened its information and cybersecurity initiatives by leveraging a managed Security Operations Center (SOC). These efforts encompass preventive measures and continuous monitoring during normal operations, incident response, and recovery activities to support business continuity.

Prevention, Monitoring, and Vulnerability Management

As part of our preventive measures, we use alerts from the SOC and threat intelligence provided by external organizations, such as JPCERT/CC, to prevent information leaks and data breaches. As a method to protect our IT assets, we have introduced Attack Surface Management (ASM) to manage IT asset risks through the continuous detection and evaluation of vulnerabilities. In addition, we collaborate with external organizations by joining the Nippon CSIRT Association and the Forum of Incident Response and Security Teams (FIRST), through which we share threat intelligence to prepare for emergencies and major incidents. We also implement a range of security controls, including strict management and periodic review of information access privileges, regular updates of security patches, login restrictions on company-provided computers and mobile devices using biometric authentication (facial and fingerprint recognition), and security reviews of installed applications. Furthermore, as a countermeasure against ransomware (endpoint technical security measures), we have introduced Endpoint Detection and Response (EDR) for PCs and servers and continuously operate and manage these systems.

Incident Response

We have established a prompt escalation process from employees to the information security supervisory divisions when an incident or suspicious event occurs. In the event of an incident, we strive to prevent the spread of damage through rapid detection and initial response. In fiscal 2025, there were no major incidents.

Business Continuity and Recovery Response

To minimize the impact of cyberattacks on our business and ensure the continuity and rapid recovery of critical operations, we have developed a business continuity plan against cyberattacks. We work to ensure its effectiveness through response training conducted in collaboration with relevant divisions.

Product Security Initiatives

Sysmex has established a Product Security Policy and set up the Product Cybersecurity Committee to promote stronger security measures for its analyzers, thereby ensuring customers can use our products with peace of mind. We continue to carry out these security enhancement activities.
In addition, we have established a Product Security Incident Response Team (PSIRT) to manage vulnerabilities throughout product design, manufacturing, and post-market phases. We regard sensitive information (including personal, patient, and test subject information) entrusted to us by our customers and those who cooperate in research and development and experimental activities, as well as advanced proprietary technologies and intellectual property related to products, as critical corporate information assets. Accordingly, we implement measures to prevent information leakage outside the Company and internal fraud.

Product Security Policy

Information and Cybersecurity Education

Sysmex implements initiatives to raise information security awareness for all Group employees. These include information security e-learning, targeted email attack simulations (addressing business email compromise [BEC] and phishing), and Company-wide training aimed at preventing ransomware damage.
To reinforce our incident response capabilities, we encourage Sysmex-CSIRT members to obtain internationally recognized security certifications, such as ISC2 CISSP, SANS GIAC, and CompTIA. Through the development of these specialized professionals, we are working to strengthen our information and cybersecurity framework.

Acquiring Information Security Certification

To enhance information security management, Sysmex has obtained ISO 27001 certification, the international standard for Information Security Management Systems (ISMS).

Sysmex Corporation (research involving personal information such as gene sequencing)
Sysmex CNA (service and support divisions)
Sysmex Europe (sales and service, IT services, etc.)
Sysmex New Zealand
Sysmex UK¹
Oxford Gene Technology¹

1In addition to ISO 27001 certification, both Sysmex UK and Oxford Gene Technology have also obtained Cyber Essentials certification (a certification system initiated in 2014 by the UK government to improve corporate cybersecurity). These entities undergo surveillance assessments every six months.