--- title: "Japan’s PM asks for attack reports the same day; ¥10bn set aside" summary: "What Prime Minister Takaichi told the second ministerial cyber meeting on 6 November: a draft four-pillar package, about ¥10bn of reserve funds, and a same-day reporting goal." url: https://www.thetechbag.com/blog/japan-cyber-package-same-day-reports format: Note desk: "Security" area: "Risk & compliance" region: Global published: 2026-11-06 facts_checked: 2026-11-06 author: TechBag (The TechBag Journal) tags: ["Japan","Sanae Takaichi","National Cybersecurity Office","Cyber Response Capability Enhancement Act","active cyber defence","incident reporting","critical infrastructure","core infrastructure operators","supply-chain risk","AI vulnerability testing","AISI Japan","IPA","CERT-In"] cover: https://www.thetechbag.com/blog/covers/japan-cyber-package-same-day-reports.png --- # Japan’s PM asks for attack reports the same day; ¥10bn set aside *What Prime Minister Takaichi told the second ministerial cyber meeting on 6 November: a draft four-pillar package, about ¥10bn of reserve funds, and a same-day reporting goal.* Note · Security · Risk & compliance · By TechBag · Published 2026-11-06 · Facts checked 2026-11-06 · Canonical: https://www.thetechbag.com/blog/japan-cyber-package-same-day-reports Japan’s Prime Minister, Sanae Takaichi, told her ministers on 6 November to aim for reports from core infrastructure operators that reach the government “if possible within a few hours, and at least within the same day” of an attack (our translation). The cabinet had set aside “about ¥10bn” (約100億円) of reserve funds that morning, she said, for measures needed at once.[1] The money and the instructions sit behind a draft, the “Cybersecurity Emergency Measures Package” (サイバーセキュリティ緊急対策パッケージ), which the meeting discussed as a draft (案). Its text has not been published.[1] **Figure: Japan wants a first report within hours; the rule in force since 1 October says only “promptly”** *Japan's reserve funds and reporting goal, 6 November 2026; the reporting rule in force from 1 October 2026; India's rule since 2022* ¥10bn reserve funds set aside on 6 November, about US$63m Prime Minister's Office Same day the Prime Minister's goal for a first report, a few hours if possible Prime Minister's Office 30 days for the full report under the rule in force; the first one is due “promptly” Cabinet Office ordinance 6 hours India: CERT-In's deadline for reporting listed incidents, since 2022 CERT-In Source: Prime Minister's Office of Japan; Cabinet Office of Japan; CERT-In · as of 6 November 2026 · the same-day goal is an instruction to ministers, not yet a rule ## What the Prime Minister asked for The package has four pillars, in her words (our translation): making sure basic measures are taken, “including with AI”; gathering and pooling information, with stronger investigation and analysis; a strategic response to cyberattacks; and more support for victims, with steps to stop damage spreading.[1] She then gave four instructions: - The cyber security minister, Furukawa, is to study amending the Cyber Response Capability Enhancement Act (サイバー対処能力強化法) to improve the government’s ability to collect information on attacks aimed at Japan. - The time it takes information to reach the National Cybersecurity Office (国家サイバー統括室) must be “greatly shortened”, to keep pace with “the speed of cyberattacks in the AI era”: hence the same-day goal for core infrastructure operators. - The office is to study, “referring to examples in major countries”, a way for it to detect and analyse suspicious traffic to private companies, “in addition to current government bodies”. - The National Security Secretariat is to lead work on rules, for the public and private sectors, that reduce supply-chain risk in IT systems and equipment, while government systems are inspected. The finance minister is to keep working on money for the whole package; the ¥10bn covers what is needed immediately.[1] TechBag countThe ¥10bn in dollars and rupees At the European Central Bank’s reference rates for 5 November (¥177.85 and US$1.1224 to the euro), ¥10bn is about US$63m, or about ₹596 crore at ₹106.0395 to the euro.[5] TechBag arithmetic; the government gave the figure in yen only. ## The rule it would tighten, in force for five weeks The Act was passed on 16 May 2025, and its reporting duty took effect on 1 October 2026. Japan has designated 258 core infrastructure operators in 15 sectors, from 65 in finance and 48 in electricity to one in postal services (as of 1 July 2026).[3] When one of them learns that a designated critical computer has been compromised, or of certain events that could lead to that, it must report “promptly” (速やかに) to its sector minister and the Prime Minister, and file a full report within 30 days of learning of it.[4] “Promptly” carries no hour count; the Prime Minister’s goal would put one on it. Provisions on the government’s use of communications data are due by November 2027.[3] The first meeting, on 26 October, had followed “large-scale information leaks” at Japanese companies. It ordered vulnerability checks of every ministry’s systems “using high-performance AI” brought forward, drawing on the expertise of AISI Japan (the AI Safety Institute), and asked the trade ministry and the information-technology agency IPA to bring forward simulated attack tests in which skilled testers use such AI to find flaws. It set the package for “around next week” (our translations).[2] The government’s text names no incident; in October the Journal covered [ransomware at the Japanese cloud provider IDC Frontier](https://www.thetechbag.com/blog/cloud-provider-ransomware-idc-frontier). In India, CERT-In’s directions of 28 April 2022 already require service providers, data centres, companies and government bodies to report listed incidents within 6 hours of noticing them.[6] To watch in Japan: the package text, a deadline in hours written into the ordinance, and the amendment bill. How we did this Figures as of 6 November 2026, 7pm IST (13:30 UTC) The Prime Minister’s remarks are from the Prime Minister’s Office pages for the meetings of 26 October and 6 November, read in Japanese and translated by us; the package itself was a draft and is not published. The current reporting rule is from the reporting ordinance under the Act; the law’s dates and the operator counts are from the National Cybersecurity Office’s October 2026 slides. The dollar and rupee figures are our arithmetic on ECB rates. Left out: press reports of the package’s contents that do not appear in the government’s published remarks. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Prime Minister's Office of Japan, サイバーセキュリティに関する関係閣僚会議 (second Ministerial Meeting on Cybersecurity; in Japanese)](https://www.kantei.go.jp/jp/105/actions/202611/06kaigi_cyber.html) — 6 November 2026 2. [Prime Minister's Office of Japan, サイバーセキュリティに関する関係閣僚会議 (first Ministerial Meeting on Cybersecurity; in Japanese)](https://www.kantei.go.jp/jp/105/actions/202610/26kaigi_cyber.html) — 26 October 2026 3. [Cabinet Secretariat National Cybersecurity Office and Cabinet Office, サイバー対処能力強化法及び同整備法について (explanatory slides; in Japanese)](https://www.cas.go.jp/jp/seisaku/cyber_anzen_hosyo_torikumi/pdf/setsumei_r810.pdf) — October 2026 4. [Cabinet Office of Japan, 特別社会基盤事業者による特定侵害事象等の報告等に関する命令 (ordinance on incident reports by core infrastructure operators, Article 4; in Japanese)](https://www.cao.go.jp/cybersecurity/pdf/meirei.pdf) — in force 1 October 2026 5. [European Central Bank, euro foreign exchange reference rates (USD, JPY, INR)](https://www.ecb.europa.eu/stats/policy_and_exchange_rates/euro_reference_exchange_rates/html/index.en.html) — 5 November 2026 6. [CERT-In, Directions under sub-section (6) of section 70B of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. **Read this next:** [3,897 SBI records leaked. Three clocks now run: 6 hours, 6 hours and 72 hours](https://www.thetechbag.com/blog/sbi-leak-three-clocks-six-hours-72-hours) — India’s reporting clocks in full: six hours to CERT-In, six to the RBI and 72 under DPDP Rule 7, as SBI’s 21 October filing showed. Go deeper on TechBag - [SIEM and log management guide](https://www.thetechbag.com/browse/security/siem-log-management) — the detection and logging that a reporting deadline in hours depends on - [Managed detection and response guide](https://www.thetechbag.com/browse/security/managed-detection-response) — round-the-clock monitoring for operators that must report the same day - [Vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) — the system checks Japan has ordered brought forward