Japan’s Active Cyber Defense Law Is Live: What Suppliers to Critical-Infrastructure Operators Should Have Ready in the First 30 Days

On October 1, 2026, Japan’s Act on Prevention of Damage Caused by Unauthorized Acts against Critical Electronic Computers (Act No. 42 of Reiwa 7, widely called the "Active Cyber Defense law" or サイバー対処能力強化法) came into force. Today is day 13. If you sell software, run systems, or host workloads for a Japanese power, telecom, finance or rail company, your customer’s compliance team is already drafting questions for you.

The statutory duties fall on the designated critical-infrastructure operators (特別社会基盤事業者). You are probably not one of them. But when something goes wrong in your environment, the facts that operator must report live in your logs, your remote-access paths and your timeline. This post is a supplier-side checklist for the first 30 days.

Disclaimer: This is general technical and operational information, not legal advice. Whether the law applies to you, and which obligations reach you through contract, should be confirmed against the primary sources below, your customer agreements, and counsel.

Related Services

• simpliLLM — On-Premise LLM / Enterprise AI Platform
• E-Commerce Platform Development Service
• ERP System Integration & Custom Development
• simpliMES — Manufacturing Execution System for Shop-Floor Operations

Show 11 more services

• EV CSMS — Charging Station Management System (OCPP/OCPI)
• Custom Software & System Development Service
• TAK Integration — Cyber-Physical Common Operational Picture
• simpliSOC — Open-Source SOC Platform / Cybersecurity Monitoring
• simpliSSO — Single Sign-On & Identity Management Service
• React Native App Development Service
• React Native AI — On-Device AI Mobile App Development Service
• Edge & Distributed Computing Development Service
• simpliShop — E-Commerce & Point-of-Sale Platform
• simpliDepot — Durian depot management system, from farm intake to buyer invoice
• simpliRecycle — Scrap-recycling depot platform: weigh-ins, A/B/C grading, FIFO inventory, and VAT invoicing

1. What the law actually requires (the parts that touch suppliers)

Based on the official explainer from Japan’s Cabinet Office cybersecurity office (PDF):

• Asset notification (Article 4). Operators notify the competent minister of their specified critical computers. Existing equipment: by March 31, 2027. New equipment: within four months of introduction.
• Incident reporting (Article 5). When a specified incident is recognized, the operator files a preliminary report, then a detailed report, then follow-ups. For ransomware and similar events the preliminary report is due within days and the detailed report within 30 days of recognition. There are three official forms (DDoS, ransomware, other); check the explainer for the exact timing per type.
• Public–private information sharing is being built out; the phase involving communications information starts in November 2027.

The reporting duty belongs to the operator. The explainer does address cases where contractors or cloud providers are involved, which is why customers will push requirements down to you.

2. Why this lands on suppliers

flowchart LR
  A["Anomaly in supplier environment"] --> B["Supplier detects"]
  B --> C["Notify operator (customer)"]
  C --> D["Operator recognizes incident"]
  D --> E["Preliminary report (days)"]
  E --> F["Detailed report (within 30 days)"]
  B --> G["Supplier provides logs and evidence"]
  G --> F

Three things determine how well you perform in that chain: how fast you detect, what evidence you can produce, and how quickly you can hand over a structured report. Late detection delays the customer’s clock; missing logs weaken their detailed report.

3. A 30-day supplier plan

Week 1: scope and contacts

• Map every path you have into the customer’s critical systems: VPN, jump hosts, remote maintenance, admin accounts, API links.
• Prepare answers to the questions you will get: notification deadlines, log retention, subcontractors.
• Name a 24/7 contact and a deputy, and share them with the customer.

Week 2: detection

• Decide what to collect: authentication, VPN/jump host, directory and admin actions, EDR, critical server OS logs, web servers.
• Deploy agents and severity-ranked rules; add IOC feeds; deduplicate alerts; set response-time SLAs.

Week 3: evidence

• One case per incident, holding alerts, notes, timeline and attachments.
• Record hashes, collector and timestamps for evidence files.
• Check retention against your contract; too short and the detailed report cannot reconstruct the past.

Week 4: reporting drills

• Build an internal template aligned to the official forms’ fields.
• Run a tabletop: how many hours from detection to first call to the customer?
• Document and agree the reporting flow (who tells whom, by what channel).

4. How this maps onto simpliSOC

simpliSOC is our open-source-based SOC stack. What is shipping today:

• Detection: Wazuh 4.x with 50+ rules across 9 categories, IOC feed matching and alert deduplication.
• Evidence and cases: DFIR-IRIS (IRIS-web) case records, with SLA timers.
• Optional automation: Shuffle workflows and a FastAPI-based SOC Integrator.
• Triage assist: a local LLM for summaries, so data stays on your infrastructure.

Not a standard feature today: automatic export into the official report forms. Mapping case data to those fields is something we would do as customization during deployment. simpliSOC is a tool for putting readiness into practice, not a "compliance guaranteed" product.

Related reading (Japanese-language posts on our site): Wazuh SOC architecture for Japanese SMEs and SOC backend for Japanese MSPs. In English: Building a SOC from scratch with Wazuh and IRIS-web.

5. FAQ

Are we in scope if we’re not a critical-infrastructure operator?
The statutory duties are on designated operators. If one of them is your customer, expect procurement terms, questionnaires and audits to carry requirements down to you. Confirm with the official materials and your customer.

Do we have to finish everything in 30 days?
The statutory "30 days" is mainly the deadline for the detailed incident report. The 30-day plan here is a practical target for being able to answer customers credibly.

When are asset notifications due?
Per the official explainer: existing equipment by March 31, 2027; new equipment within four months of introduction. That is the operator’s obligation.

Is an open-source SOC acceptable to Japanese customers?
What matters is that you can show detection coverage, log retention, case records and a reporting procedure. Open source can help in audits because you fully know the configuration.

Can a small team do this?
Yes, if you start with the access paths into the customer’s environment rather than your whole company.

Sources

• Official explainer, Cabinet Office cybersecurity office (Oct 2026, Japanese)
• Cabinet order summary, INTERNET Watch (Japanese)

---

Simplico Co., Ltd. builds SOC and business systems for companies in Japan. Contact us at simplico.net.