On 1 October 2026 Japan switched on the operational heart of its active cyber defence regime. Designated core-infrastructure operators must now report qualifying incidents to their sector minister and the Prime Minister, file inventories of critical computers, and sit inside a new public-private council. State access-and-neutralisation powers against attack infrastructure took effect the same day. Here is what changed, who it hits, and what to do before the March asset deadline.
Applies to: Japan. Specified Essential Infrastructure Service Providers designated under the Economic Security Promotion Act (258 operators across 15 sectors, per the Cabinet Office). Not UK, EU or US law. Suppliers are not directly designated, but operators will lean on them for logs, forensics and reporting support.
What went live on 1 October
Japan’s Cyber Response Capability Enhancement Act — formally the Act on Preventing Damage Caused by Unauthorized Acts Against Important Electronic Computers (Act No. 42 of 2025) — is being phased in after May 2025 enactment. The Cabinet Office and National Cyber Office (NCO) explainer (opens in a new tab) for September 2026 is blunt: from 1 October, core-infrastructure operators face asset notification, incident reporting and a new Cyber Council, while the companion Arrangement Act lets the state access and, where approved, neutralise confirmed attack servers.
Digital Minister Furukawa confirmed it the next day, in a 2 October press conference (opens in a new tab): public-private information sharing and access-and-neutralisation measures commenced on 1 October. Use of communications information for detecting attack infrastructure waits until autumn 2027. Do not wait for that second date before standing up reporting.
The same day also brought the Unified Standards for Cybersecurity Measures for Critical Infrastructure into force. Those standards set a government baseline for governance, risk, incident response and supply-chain security. They are not a freestanding fine schedule, but ministries will fold them into sector guidance.
Who is caught
Direct duties fall on Specified Essential Infrastructure Service Providers — entities designated by the competent minister under the Economic Security Promotion Act. The Cabinet Office counts 258 operators in 15 sectors, covering electricity, gas, petroleum, water, rail, telecoms, finance, aviation, defence industry and related services. Designation is public. If you are not on the list, you are not the reporting entity. If you sell kit, cloud or detection into those operators, you will still feel the pull: the clock does not pause while a vendor digs for logs.
Incident reporting: two clocks
Article 5 of the Act, read with the October 2026 ministerial ordinance and the Cabinet Office reporting commentary (opens in a new tab) dated 1 October 2026, requires a two-stage report to the sector minister and the Prime Minister when the operator recognises a specified intrusion event, or a prescribed precursor, on a critical computer:
- Initial report (速報): for DDoS, as soon as practicable after recognition; for ransomware and other cyber attacks, within three to five days of recognition.
- Detailed report (詳報): within 30 days of recognition.
Recognition is not every SOC alert. It is the point at which the operator can reasonably judge that an Article 5 event has occurred — from monitoring, hunting, forensics or a cloud-provider notice. Third parties and SaaS providers may see the event first, so contracts need a path that gets the designated operator the facts in time. Follow-ups are expected when new facts emerge.
Asset notification by 31 March 2027
Article 4 requires notification of specified critical computers to the sector minister, who notifies the Prime Minister. For systems already in place at commencement, the transitional rule is six months from 1 October 2026: 31 March 2027. New introductions after that are due within four months of introduction; material changes within four months of the change. The inventory is the feed government intends to match against unpublished vulnerability intelligence, so it can warn the right operator rather than the whole sector.
What the state can now do
Separately from operator duties, the Arrangement Act’s access-and-neutralisation powers also applied from 1 October. Under oversight that includes the Cyber Communications Information Supervisory Commission, authorities can access servers used in serious attacks and stop or remove malicious code. That is a government capability, not a private right of self-help.
What to do
- Confirm whether any Japan entity in the group is a designated Specified Essential Infrastructure Service Provider. If yes, name the Article 5 reporting owner and the Article 4 asset owner now.
- Rewrite the incident runbook for the Japan clocks: DDoS as soon as practicable; ransomware and other attacks in three to five days; detailed report in 30 days; dual addressees (sector minister and Prime Minister).
- Force cloud, telecom and MSSP contracts to push qualifying notices to the designated operator inside those clocks, with forensic packages that match the ordinance fields.
- Build the critical-computer inventory against the ordinance categories and file by 31 March 2027.
- If you supply designated operators, pre-agree log retention, evidence hand-off and out-of-hours contacts. Their reporting duty is already live; your delay becomes their problem.
Primary sources: Cabinet Office / NCO September 2026 commencement explainer; Cabinet Office 1 October 2026 reporting and asset-notification commentary; Digital Minister Furukawa press conference, 2 October 2026; Act No. 42 of 2025 and the October 2026 ministerial ordinance on e-Gov.
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)