Daiwa Securities Group Annual Report 2012 IT Strategy and Information Security IT Strategy Information Security <IT Governance System> <Measures for Maintaining Information Security> <IT Strategy> <Efforts to Enhance the Level of Information Security> 43 The Daiwa Securities Group aims to provide customers with high value-added products and services quickly,  precisely, and reasonably priced. To this end, it uses IT strategically. As an active participant in the financial and  capital markets, the Group possesses information resources, including personal information. In order to protect  these information resources from outside threats, the Group is working to maintain and improve the level of its  information security. The Group has established the Group IT Strategy Committee as  a subcommittee of the Executive Management Committee. This  committee deliberates and makes decisions on such issues as  budgets for IT investment and the allocation of IT functions. In  regard to IT investment planning, the Group IT Strategy Commit- tee rigorously selects the IT investments necessary for the  Group and allocates budgets based on the strategic importance  of each investment. Additionally, the Group IT Strategy Committee is strengthening  Group IT governance by primarily bolstering the management and  control function in connection with managing systems construction  projects within the Group. The Group strategically uses IT to achieve its main goal of improv- ing its competitive edge while maintaining the effectiveness of con- trol over the quality and costs of system services. In FY2011,  management and control over IT-related budget execution was  strengthened, along with the construction of a new infrastructure  system for online trading and systems that were adapted for the  consolidation of securities subsidiaries (the merger of Daiwa  Securities Co. Ltd. and Daiwa Securities Capital Markets Co. Ltd.). Starting FY2012, the Group, aiming for sustainable growth,  will begin promoting the two IT strategies (basic IT policies) of  “raising the cost competitiveness of business infrastructures  through reconstruction,” and “strengthening IT governance” under  its “new” Medium-Term Management Plan “Passion for the Best”  2014. In accordance with the plan, the Group will re-examine  both the functions and scale of existing business infrastructures  and reconfigure them so as to enable the “new” Daiwa Securities  to provide services more efficiently in both the retail business and  wholesale business. In order to fulfill its social responsibility as an active participant in  the financial and capital markets, as well as gain the trust of cus- tomers, the Group has adopted a full spectrum of information  security policies at companies throughout the Group to ensure that  important personal information received from customers and all  other information resources are managed in a secure and appropri- ate manner. Among the organizational measures that we have adopted is  the Information Security Group Minimum Standard, which dictates  the basic rules that all companies in the Group must adopt for  handling information. In addition to introducing these information  security rules at each company, we have appointed a “Chief Infor- mation Security Officer” at each Group company to oversee infor- mation management activities. A variety of technical and structural measures have also been  introduced to enhance security and ensure that Group information  resources are managed appropriately, such as office automation  through the use of thin clients and high-security access controls at  the data center. The online trading systems of Daiwa Securities Co.  Ltd. employ highly advanced encryption technology for data trans- mission and for user ID verification, thereby ensuring that clients are  able to use the system safely and securely. The Group has put in place a self-assessment scheme for employ- ees in order to maintain and build upon the current level of informa- tion security across the Group as a whole. Each Group company  has formulated further initiatives tailored to meet the information  security needs of the products and services they offer. Additionally, in recognition of the importance of human factors  in effective information security systems, the Group has introduced  training programs to educate all executives and employees in the  basics of information security. The programs are offered periodically  as group training sessions, as well as through e-learning.