JICSS Response to OT Security Guidelines for Semiconductor Device Factories – Japan Institute for CyberSpace Studies

Executive Summary

The Japan Institute for CyberSpace Studies (JICSS) commends the Ministry of Economy, Trade and Industry’s comprehensive approach to securing Japan’s semiconductor manufacturing infrastructure through the OT Security Guidelines for Semiconductor Device Factories. As a cybersecurity research organization focused on strengthening Japan’s cyber resilience, JICSS offers this response to emphasize critical considerations for edge computing environments, hybrid cloud architectures, and AI-specific security challenges that will shape the future of semiconductor manufacturing security.
Our response highlights three fundamental areas where the guidelines could be enhanced to address evolving threats: (1) the critical importance of securing edge computing and AIoT ecosystems within semiconductor fabs, (2) the necessity of hybrid cloud security frameworks that balance operational efficiency with national security imperatives, and (3) the unique cybersecurity challenges posed by AI systems that extend beyond traditional privacy concerns to encompass economic security and national resilience.

Click here to Dowload the Whitepaper

Privacy Policy

The Japan Institute for CyberSpace Studies (hereinafter referred to as "JICSS") has established the following privacy policy (hereinafter referred to as "the Policy") regarding the handling of personal information of users in the services provided on this website (hereinafter referred to as "the Services").

Article 1 (Personal Information)
“Personal information” refers to "personal information" as defined in the Act on the Protection of Personal Information, and includes information about living individuals that can be used to identify specific individuals by name, date of birth, address, telephone number, contact information, and other descriptions, as well as data related to appearance, fingerprints, voiceprints, and health insurance card insurer numbers.

Article 2 (Method of Collecting Personal Information)
When you submit an inquiry form, JICSS will obtain your name and e-mail address.

Article 3 (Purpose of Collection and Use of Personal Information)
The purposes for which JICSS collect and use personal information are as follows

To provide and operate our services
To respond to inquiries from users (including identification)
To send e-mail notifications of new features, updates, campaigns, etc. of the service the user is using, as well as information on other services provided by the Company.
To contact you as necessary for maintenance, important notices, etc.
To identify users who violate the Terms of Use or who attempt to use the service for illegal or unjust purposes, and to refuse their use of the service.
To allow users to view, change, or delete their own registration information, or to view the status of their use of the service.
To bill users for paid services.
For purposes incidental to the above purposes of use

Article 4 (Change of Purpose of Use)
JICSS shall change the purpose of use of personal information only when it is reasonably recognized that the purpose of use is related to the purpose of use before the change.
In the event of a change, JICSS shall notify the User of the changed purpose or publicly announce it on this website in a manner prescribed by JICSS.

Article 5 (Provision of Personal Information to Third Parties)
Except in the following cases, JICSS will not provide personal information to a third party without the prior consent of the user. However, this excludes cases permitted under the Personal Information Protection Law and other laws and regulations.
When it is necessary for the protection of the life, body, or property of an individual and it is difficult to obtain the consent of the individual.
When the provision of personal information is especially necessary for improving public health or promoting the sound growth of children, and it is difficult to obtain the consent of the individual concerned.
When it is necessary to cooperate with a national agency, a local government, or an individual or entity entrusted by either a national agency or local government to execute affairs prescribed by law, and obtaining the consent of the individual is likely to impede the execution of such affairs.
When we have notified or announced the following matters in advance, and when we have notified the Personal Information Protection Committee
The purpose of use includes provision to a third party
Data items to be provided to the third party
Means or method of provision to third parties
Cessation of provision of personal information to third parties at the request of the individual
The method of accepting the request of the person in question
Notwithstanding the provisions of the preceding paragraph, in the following cases, the party to which the relevant information is provided shall not fall under the category of a third party.
(i) When we outsource all or part of the handling of personal information within the scope necessary for the achievement of the purpose of use
When personal information is provided as a result of the succession of business due to a merger or other reasons
When personal information is used jointly with a specific person, and the Company notifies the person in advance or makes the information readily accessible to the person in advance to that effect, the items of personal information jointly used, the scope of joint use, the purpose of use by the person using the information, and the name of the person responsible for managing the personal information Article 6 (Disclosure of Personal Information)

Article 6 (Disclosure of Personal Information)
When requested to disclose personal information by the person in question, JICSS will disclose such information to the person without delay. However, if JICSS decides not to disclose the personal information, it will notify the individual to that effect without delay. A fee of 1,000 yen will be charged for each case of disclosure of personal information.
When there is a risk of harm to the life, body, property, or other rights or interests of the person concerned or a third party
If there is a risk of significant hindrance to the proper conduct of our business
If it violates any other laws or regulations.
Notwithstanding the preceding paragraph, in principle, JICSS will not disclose information other than personal information, such as historical information and characteristic information.

Article 7 (Correction and Deletion of Personal Information)
If the User's personal information held by JICSS is incorrect, the User may request JICSS to correct, add, or delete (hereinafter referred to as "correct, etc.") his/her personal information in accordance with procedures determined by JICSS.
If we deem it necessary to respond to the request from the user as described in the preceding paragraph, we will make the correction, etc. to the relevant personal information without delay.
In the event that JICSS makes corrections, etc. based on the preceding paragraph, or decides not to make such corrections, etc., JICSS will notify the User of such decision without delay.

Article 8 (Suspension of Use of Personal Information)
When we receive a request from a user to stop using or delete (hereinafter referred to as "stop using, etc.") his/her personal information on the grounds that it has been handled beyond the scope of the purpose of use or that it has been obtained by wrongful means, we will conduct the necessary investigation without delay.
If, based on the results of the investigation described in the preceding paragraph, we determine that it is necessary to comply with the request, we will suspend the use of the relevant personal information without delay.
When JICSS suspends the use of personal information in accordance with the preceding paragraph or decides not to suspend the use of personal information, JICSS will notify the user of this decision without delay.
Notwithstanding the preceding two paragraphs, in cases where the suspension of use involves a large amount of cost or it is otherwise difficult to suspend the use of personal information, and alternative measures can be taken to protect the rights and interests of the user, these alternative measures shall be taken.

Article 9 (Changes to Privacy Policy)
The contents of this Privacy Policy may be changed without notice to the User, except as otherwise provided by law or other regulations.
Unless otherwise specified by the Company, the revised Privacy Policy shall take effect from the time it is posted on the Website.

Article 10 (Contact for Inquiries)
Inquiries regarding this policy should be directed to the following contact