IPA IP 2021 Question 32

A, B and C — the Basic Act on Cybersecurity sets out all three: the basic principles of policy, the responsibilities of the national and local governments, and the efforts expected of citizens.

The Act (2014) is Japan's framework law for cybersecurity policy. It states the basic principles for promoting cybersecurity measures (C); the responsibilities of the national government and of local governments (A), and of critical infrastructure operators, cyberspace-related businesses and universities; and it asks citizens to deepen their awareness of the importance of cybersecurity and to endeavor to ensure it themselves (B). On that basis it provides for a national cybersecurity strategy and a headquarters in the Cabinet. As a framework law it says who is responsible for what and on which principles; it does not prohibit or punish acts.

Answer (b)

Why not others:

• •(a) — leaves out C, yet the basic principles are the core of the Act and every other provision rests on them
• •(c) — leaves out B: the Act also gives citizens a duty to make efforts, not only the public sector
• •(d) — leaves out A, the responsibilities of the national and local governments, which the Act exists to set out

Key rule: A Japanese basic act sets basic principles, the responsibilities of the state and local governments, and the efforts expected of businesses and citizens; the specific prohibitions and penalties are in other laws.

Legal Affairs · AI-written, may contain errors