Sustainability | GovernanceInformation Security

Our Approach
Governance
Strategy
Risk Management
Metrics and Targets
Initiatives

Our Approach

Governance

TDK has established the Information Security Committeeunder the Executive Committee to oversee measures addressing information security risks across the TDK Group. The Information Security Committee is chaired by a corporate officer and reports to the President and CEO once every quarter and to the Audit & Supervisory Board members twice a year.
In addition, to strengthen its information security governance, TDK has put in place a system whereby representatives of both head office functions and regional headquarters can be asked to serve as non-permanent members of the Information Security Committee, thereby enabling it to respond flexibly depending on the issue being addressed.

Information security management organization (As of June 2026)

TDK requires each company to appoint an Information Security Administration Manager and operates a system under which incidents are reported to the Information Security Committee whenever, for example, an information security incident occurs or a team member (employee) notices suspicious activity. In addition, based on the governance framework described above, we have established reporting and escalation procedures according to the criticality and urgency of an incident. In the event of a critical information security incident, or upon detection of such an incident, the Information Security Committee responds promptly in coordination with the ERM Committee.

Strategy

TDK recognizes information security as a critical management issue, as cyberattacks can disrupt production, sales, marketing, R&D, and other business activities, while information leakage can result in a loss of trust and credibility.
To prevent information security incidents and mitigate their impact, TDK is strengthening its information security measures in alignment with the Cybersecurity Framework of the U.S. National Institute of Standards and Technology (NIST), which consists of six core functions: (1) Govern, (2) Identify, (3) Protect, (4) Detect, (5) Respond, (6) Recover.

[Principal Measures]

TDK Zero Trust Implementation ((2) Identify, (3) Protect, (4) Detect)
To prevent information security incidents and mitigate their impact, TDK is advancing the implementation of its Zero Trust architecture.
Zero Trust means constantly restricting and monitoring access to all users, devices, and networks, thus preventing attacks from outside and controlling internal proliferation. We will build TDK Zero Trust in a manner appropriate to TDK’s business environment.
Supply Chain Security ((1) Govern)
To reduce the risk of business disruption, TDK continuously assesses and enhances information security practices across the TDK Group.
Internal Security Risk Management ((3) Protect, (4) Detect, (5) Respond)
To prevent information leakage and maintain trust and credibility, AI-based monitoring tools and other measures are used to detect and prevent unauthorized or inappropriate internal activities.
Incident Response ((5) Respond, (6) Recover)
TDK has established a Computer Security Incident Response Team (CSIRT) to respond rapidly to information security incidents, minimize their impact, and support prompt recovery. Response procedures and escalation protocols are defined in the Computer Security Incident Response Plan (CSIRP).

Risk Management

The Information Security Committee monitors emerging cybersecurity trends and reports its findings to senior management. For risks identified as significant, the Committee reviews the status of risk mitigation measures across the TDK Group. Where additional measures are required, appropriate actions are developed and implemented throughout the TDK Group.
The Committee also works closely with the Enterprise Risk Management (ERM) Committee to address enterprise-level risks.
With respect to external threats, TDK continuously evaluates security risks from the perspective of potential cyberattackers and through monitoring of its internet-facing environment. When high-risk vulnerabilities are identified, prompt remediation measures are taken.
In addition, website protection services are employed to defend against external attacks.
With respect to internal risks, TDK implements measures to prevent team members from disclosing information without authorization.

Metrics and Targets

Medium- to Long-Term Targets

TDK Zero Trust
To prevent information security incidents and mitigate their impact, TDK will continue to advance the implementation of its Zero
Trust architecture. Zero Trust is a security model that continuously verifies and monitors access by users, devices, and networks to prevent unauthorized access and limit the impact and spread of security threats. TDK will implement its Zero Trust architecture in a manner suited to its business environment.
Vulnerability Assessment of Internet-Facing Environment
800 points or higher (Grade A) out of a maximum of 950 points across all assessed systems.

FY March 2026: Select security solutions for implementation of TDK Zero Trust
FY March 2027: Deploy selected security solutions across the TDK Group

Goals and Achievements in FY March 2026

FY March 2026 Goals	Achievements
Select security solutions for implementation of TDK Zero Trust	Selected security solutions in the TDK Zero Trust global project
Vulnerability assessment of internet-facing environment 800 points or higher (Grade A) out of a maximum of 950 points across all assessed systems.	Continued to achieve 800 or more points (Grade A) Continued global monitoring for all assessed systems, and responded to identified risks as necessary

[Main Achievements]

TDK strengthened information security measures in accordance with the NIST Cybersecurity Framework.

TDK Zero Trust ((2) Identify, (3) Protect, (4) Detect)
Defined the target security level for implementation of the TDK Zero Trust architecture and selected security solutions.
Supply Chain Security ((1) Govern)
Assessed the state of information security and supported improvement initiatives focusing on key suppliers. Expanded related activities across the TDK Group.
Internal Security Risk Management ((3) Protect, (4) Detect, (5) Respond)
Continued deployment of AI-based monitoring tools across the TDK Group and strengthened measures to mitigate internal security risks.
Incident Response ((5) Respond, (6) Recover)
Continued information security incident response training (for management, overseas sites, etc.)

Evaluations and Future Activities

In FY March 2026, the second year of implementation of TDK Zero Trust, TDK defined the target security level to be achieved across the TDK Group, selected security solutions, and further refined its implementation plans.
In FY March 2027, TDK will begin deploying the solutions selected in FY March 2026 across the TDK Group, with the aim of further enhancing its overall security posture.

Initiatives

Initiatives to Strengthen Information Security

TDK Zero Trust
In FY March 2026, TDK defined the target security levels to be achieved across five key areas(i.e., authentication and authorization, network access, AI monitoring, device, and network segmentation and micro-segmentation), and selected security solutions to be implemented across the TDK Group.
Supply Chain Security

To reduce the risk of disruption to TDK's business activities, TDK continues to implement the following measures across the Group to assess and strengthen information security practices both within TDK and among key suppliers.
In response to changes in the cybersecurity landscape, the scope of these activities has been expanded.
- Questionnaire-based assessments to evaluate information security management systems and related governance processes
- Vulnerability assessments of internet-facing environments
- Site-specific assessments to verify actual operational practices
Internal Security Risk Management
To prevent information leakage and maintain trust and confidence, TDK continued the deployment of AI-based monitoring tools across the TDK Group and strengthened measures to address internal security risks.
Incident Response
Incident response training was conducted for senior management to clarify roles and responsibilities and strengthen decision-making capabilities.
Training was also conducted at TDK Group sites for first responders to clarify the procedures to be followed in the event of an incident.

TDK's Initiatives Featured in the Declaration of Partnership Building

TDK’s initiatives relating to supply-chain security were introduced in the case list of Declaration of Partnership Building efforts compiled by Japan’s Small and Medium Enterprise Agency:

Information Security Training

To maintain and enhance information security across the TDK Group, information security education and targeted e-mail attack training are provided to all team members at least once per year.

Information security education is conducted for computer users at each Group site. The content and frequency of the training are tailored to the environment and current circumstances of each site.
As part of the targeted e-mail training, simulated phishing e-mails based on real-world attack methods are sent to team members to assess their responses and identify how many open attachments or click on links.
TDK will continue to strengthen information security education and training by incorporating the latest security trends and other relevant updates, to address risks that cannot be fully mitigated through technical controls alone.

Vulnerability Identification and Remediation

TDK continuously monitors its internet-facing systems from an external attacker’s perspective and takes prompt action when vulnerabilities requiring countermeasures are identified. In addition, third-party vulnerability assessments are conducted across the TDK Group at least once per year to identify and remediate information security vulnerabilities.

Strengthening Response to Security Incidents

A Computer Security Incident Response Team (CSIRT) has been established to respond to information security incidents, and response procedures and escalation protocols are defined in the Computer Security Incident Response Plan (CSIRP).
TDK Group has formulated a Business Continuity Plan (BCP). In addition, IT-BCP training based on information security incident scenarios is conducted at least once per year, and the BCP is regularly reviewed and updated.

Information Security Certifications

A number of TDK Group sites have obtained TISAX certification under the Trusted Information Security Assessment Exchange (TISAX), an information security assessment and exchange mechanism established by the German Association of the Automotive Industry (VDA).

Related Information

Protection of Personal Data

Based on the TDK Privacy Policy, TDK endeavors to protect personal data and privacy. In addition, TDK has established the TDK Personal Data Protection Basic Policy as part of the TDK Privacy Policy, which applies to all personal data handled by TDK.

Filing of Complaints Regarding Privacy Violations

There were no reports or complaints received within Group companies concerning the infringement of customer privacy or the loss of customer data in FY March 2026.

TDK logo is a trademark or registered trademark of TDK Corporation.