Sustainability | GovernanceInformation Security

Our Approach
Governance
Strategy
Risk Management
Metrics and Targets
Initiatives

Our Approach

Governance

TDK has set up the Information Security Committee under the Executive Committee to adopt measures in response to information security risks in the Group as a whole. The Information Security Committee is chaired by a corporate officer and reports to the President and CEO once every quarter and to the Audit & Supervisory Board members twice a year.
In addition, to strengthen its information security governance, TDK has put in place a system whereby representatives of both head office functions and regional headquarters can be asked to serve as non-permanent members of the Information Security Committee, thereby enabling it to respond flexibly depending on the issue being addressed.

Information security management organization (As of June 2026)

TDK requests the appointment of an information security administration manager in each company and operates a system by which a report is submitted to the Information Security Committee whenever, for example, an information security incident occurs or a team member (employee) notices something suspicious. In addition, based on the above governance setup, we stipulate the reporting route in response to the level of seriousness and emergency of an incident. In the case of a serious incident occurring or being detected, the Information Security Committee would respond swiftly in conjunction with the ERM Committee.

Strategy

Since such occurrences as the stoppage of production, sales, marketing, R&D, and other activities due to cyberattacks and the loss of trust and reliability due to the leakage of information have a serious business impact, TDK considers information security to be an important management issue.
To prevent the occurrence of damage and to minimize damage in the event of an incident, TDK is strengthening information security measures based on the Cybersecurity Framework of the US National Institute of Standards and Technology (NIST) ((1) govern, (2) identify, (3) protect, (4) detect, (5) respond, (6) recover).

[Principal Measures]

Building of TDK Zero Trust ((2) identify, (3) protect, (4) detect)
To prevent the occurrence of damage and to minimize damage in the event of an incident, we will undertake the building of TDK Zero Trust.
Zero Trust means constantly restricting and monitoring access to all users, devices, and networks, thus preventing attacks from outside and controlling internal proliferation. We will build TDK Zero Trust in a manner appropriate to TDK’s business environment.
Supply-chain security ((1) govern)
To prevent TDK’s business activities from coming to a halt, we are monitoring the state of information security and making improvements not only at TDK but at all TDK Group companies.
Measures to counter the risk of internal irregularities ((3) protect, (4) detect, (5) respond)
To prevent the loss of trust and reliability due to the leakage of information, we will prevent internal irregularities by using AI monitoring tools, etc.
Incident response ((5) respond, (6) recover)
We have established the Computer Security Incident Response Team (CSIRT) as an organization to respond to information security incidents in a manner that minimizes damage and enables speedy recovery, and we have stipulated our response setup and response plan should an information security incident occur in the Computer Security Incident Response Plan (CSIRP).

Risk Management

The Information Security Committee conducts surveys of the latest security trends, and reports on the results to senior management. With regard to risks that are of significant concern, we verify the status of risk countermeasures within the TDK Group, and in the case of risks that require additional response measures, we formulate appropriate measures and then roll them out throughout the TDK Group.
We also liaise with the Enterprise Risk Management (ERM) Committee in regard to enterprise-level risks.
As regards external risks, we are constantly evaluating risks from the perspective of hackers who might launch cyber-attacks, and from the perspective of the Internet. In the case of high-risk vulnerabilities that need addressing, we take action promptly.
We make use of a website protection service to block external attacks on our website.
With regard to internal risks, we are implementing countermeasures to prevent team members from disclosing information outside the company without authorization.

Metrics and Targets

Medium- to Long-Term Targets

TDK Zero Trust
To prevent the occurrence of damage and to minimize damage in the event of an incident, we will undertake the building of TDK Zero Trust. Zero Trust means constantly restricting and monitoring access to all users, devices, and networks, thus preventing attacks from outside and controlling internal proliferation. We will build TDK Zero Trust in a manner appropriate to TDK’s business environment.
Assessment of vulnerabilities by an external disclosure environment evaluation system
800 or more points out of a total of 950 points for all assessed systems (Grade A)

FY March 2026: Select global security solutions to realize TDK Zero Trust
FY March 2027: Implement global adoption of security solutions selected to realize TDK Zero Trust

Goals and Achievements in FY March 2026

FY March 2026 Goals	Achievements
Select global security solutions to realize TDK Zero Trust	Selected security solutions in the TDK Zero Trust global project
Assessment of vulnerabilities by an external disclosure environment evaluation system: 800 or more points out of a total of 950 points for all assessed systems (Grade A)	Continued to achieve 800 or more points (Grade A) Continued global monitoring for all assessed systems, and responded to identified risks as necessary

[Main Achievements]

TDK strengthened information security measures in accordance with the NIST Cybersecurity Framework.

Building of TDK Zero Trust ((2) identify, (3) protect, (4) detect)
We defined the security level needed to realize the TDK Zero Trust framework, and considered and selected the optimal solutions
Supply-chain security ((1) govern)
Focusing on key suppliers, we checked the state of information security in our supply chain and supported improvements; we also expanded the scope of related activities undertaken within the TDK Group.
Measures to counter the risk of internal irregularities ((3) protect, (4) detect, (5) respond)
As a measure to counter the risk of internal irregularities, we steadily introduced AI monitoring tools to TDK Group business sites and continued to strengthen our measures to prevent internal irregularities.
Incident response ((5) respond, (6) recover)
We continue to conduct training on information security incidents (for management and overseas business sites, etc.)

Evaluations and Future Activities

In FY March 2026, the second year of implementation of TDK Zero Trust, we defined the security level that needs to be realized in all TDK Group companies, selected appropriate solutions, and added more concrete detail to our plans.
In FY March 2027, we will be commencing adoption of the solutions decided on in FY March 2026, and will be aiming to enhance the overall security level.

Initiatives

Initiatives to Strengthen Information Security

Building TDK Zero Trust
In FY March 2026, with regard to the five key aspects that need to be realize in order to build the TDK Zero Trust framework (i.e., certification and approvals, network access management, AI-assisted monitoring, device controls, and network segmentation and micro-segmentation), we defined the required security level, and considered and selected optimal solutions on a global scale.
Supply-chain security

To prevent interruption to TDK’s business activities, we have been rolling out the following measures across all TDK Group companies, proceeding with the clarification of information security status not only in TDK but also for key suppliers, and making improvements where needed.
In light of the latest changes in the information security environment, we have expanded the scope of our activities.
- Using questionnaire surveys to verify the state of the information security management system and the rules governing its operation
- Using an external disclosure environment evaluation system to determine vulnerabilities
- Using individual surveys to verify actual operational status
Strategies to Address Risks Relating to Internal Irregularities
To prevent the loss of trust and confidence due to the leaking of information, we have continued to expand the adoption of AI monitoring tools to cover TDK Group business sites, and we have been implementing various measures to counter risks relating to internal irregularities.
Incident Response
We implemented incident response training for senior management, clarifying the role that senior management are expected to play, and how they should respond.
For frontline personnel who will actually be implementing the response to incidents, we implemented incident response training at our business locations in Japan and overseas, and we clarified the procedures that should be followed when an incident occurs.

[Introduction of TDK’s Declaration of Partnership Building initiatives]

TDK’s initiatives relating to supply-chain security were introduced in the case list of Declaration of Partnership Building efforts compiled by Japan’s Small and Medium Enterprise Agency:

Information Security Education

To maintain and enhance information security throughout the entire TDK Group, we implement information security education and training in dealing with targeted e-mail attacks for all team members at least once a year.

Information security education is implemented for computer users at each Group business site. The content and frequency of the education is tailored to suit the environment and current status of each site.
With the e-mail training, an e-mail modeled on a real phishing e-mail is sent to each team member, to verify the number of team members who open the attachment or click on the URL.
We will continue to enhance education and training for team members by reflecting the latest security trends and other relevant updates, and the entire Group will address risks that cannot be fully covered by systems alone.

Identification and Improvement of Vulnerabilities

We carry out constant and global monitoring from the Internet side from the perspective of hackers launching cyberattacks and swiftly take action in the case of risks of high vulnerability requiring countermeasures. Furthermore, one or more times a year we implement third-party vulnerability diagnosis in the TDK Group so as to identify and improve vulnerabilities in the management of information security.

Strengthening of Response to Security Incidents

We have established the Computer Security Incident Response Team (CSIRT) as an organization to respond to information security incidents and have stipulated our response setup and response plan should an information security incident occur in the Computer Security Incident Response Plan (CSIRP).
The TDK Group has formulated a Business Continuity Plan (BCP). In addition, we implement IT-BCP training one or more times a year based on information security incident scenarios and, in light of the results, regularly review the BCP.

External Certification of Information Security Management

A number of TDK Group business sites have been awarded Trusted Information Security Assessment Exchange (TISAX) information security certification, which was initiated by the German Association of the Automotive Industry (VDA).

Related Information

Protection of Personal Data

Based on the TDK Privacy Policy, TDK endeavors to protect personal data and privacy. In addition, we stipulate the TDK Personal Data Protection Basic Policy as part of the TDK Privacy Policy, which is applicable to all personal data handled by TDK.

Filing of Complaints Regarding Privacy Violations

In FY March 2026 there were no reports or receipt of complaints in Group companies concerning the infringement of customer privacy or the loss of customer data. There were also no instances of using customer data for secondary purposes.

TDK logo is a trademark or registered trademark of TDK Corporation.