Risk Management
Basic Approach
Zeon positions the appropriate identification, across the organization, of the wide range of risks that may affect its business operations, as well as their prevention and mitigation, and prompt and appropriate responses when risks materialize, as a key management issue. For this purpose, we continuously develop and operate a company-wide risk management framework, and manage the entire process in an integrated manner, from identification of potential risks to prevention, response in the event of occurrence, and measures to prevent recurrence. In addition, we work to enhance our resilience and create sustainable corporate value by preparing for key risks such as compliance, information security, and business continuity, strengthening our response to emerging risk areas including climate change and human rights, and maintaining an early detection system through our internal reporting (whistleblowing) framework.
Risk Management System
We have established the Risk Management Committee as the body responsible for building and operating a company-wide risk management framework. The Committee works to identify, assess, and prevent potential risks that could affect business activities, and promotes the development and operation of a company-wide system for responding promptly and appropriately to, and resolving, risks that have materialized.
In Group-wide risk assessments, evaluations are conducted taking into account business content and regional characteristics, and risks related to corruption in general, including bribery and fraudulent activities, are also covered. This enables a comprehensive understanding of governance-related risks inherent in business operations and supports appropriate control activities. Individual risks that have materialized are handled, on their own initiative, by the departments responsible for managing those risks, and are reported to the Risk Management Committee together with the root-cause analysis, the formulation of measures to prevent recurrence, and the status of horizontal deployment across the Group. The Risk Management Committee monitors whether risk management across the Zeon Group is being appropriately controlled and prepares a company-wide Risk List. Based on this list, the Committee regularly reports on control activities related to critical Group-wide risks to the Management Committee and the Board of Directors to confirm the effectiveness of risk management. In addition, each organization prepares its own Risk List, identifies both Group-wide risks and risks specific to that organization, and implements necessary control activities based on this identification. The Risk Management Committee compiles evaluations and control activities for these individual risks and shares them with relevant departments, thereby enhancing the effectiveness of Group-wide risk control activities.

BCP Formulation and Training
To minimize the impact on business continuity from disasters such as earthquakes and severe storm and flood damage, we have formulated a Business Continuity Plan (BCP) and conduct training to enhance its effectiveness. In FY2025, we conducted two company-wide emergency response headquarters drills and two company-wide emergency response headquarters secretariat drills. Through these drills and other activities, we verify the effectiveness of our BCP and work to strengthen our resilience to disasters.
In addition, each business division and plant has formulated its own BCP and established systems that enable a rapid response in the event of an emergency. Furthermore, through continuous review under our Business Continuity Management (BCM) and the implementation of our own training programs, we strive to maintain and enhance the effectiveness of our BCP.
Whistleblowing System
We have put in place a confidential whistleblowing system to identify information about potential risks as early as possible so that appropriate action can be taken. Reporting channels for risk information include internal channels such as reporting through superiors and reporting directly to the Compliance Department. We have also set up the web-based Compliance Helpline, which allows anonymous reporting. In addition, we have established the Lawyer HOTLINE, with an outside attorney serving as the contact point, broadening the options available to whistleblowers (1 to 4 in the flowchart).
This whistleblowing system accepts reports related to overall compliance, including harassment, human rights violations, corruption and bribery, theft, fraud, threats, insider trading, and information security issues.
Upon receiving a report, the Compliance Department investigates the facts regarding the report, while giving the utmost consideration to the privacy of the whistleblower and maintaining confidentiality, and, based on the results, takes appropriate actions such as instructing relevant internal departments to implement countermeasures.
We also make the system known to employees, including its purpose, so that whistleblowers who report in good faith are not subjected to dismissal, reassignment, discrimination, or any other disadvantageous treatment because of their report.

Information Security
We recognize that cyber-related incidents constitute one of the risks that may impede business operations. To ensure business continuity and growth and to maintain social trust, we are committed to securing the digital environment, including information systems and industrial control systems.
Under the leadership of senior management, all directors, officers, and employees, together with our business partners, will address the expectations of diverse stakeholders and promote initiatives based on the following policy in order to establish and maintain a resilient cybersecurity framework.
- 1Management Responsibility and Governance Structure
We position cybersecurity as a key management priority. Senior management will take the lead in implementing risk-based measures. We will establish a company-wide framework and promote coordinated efforts across relevant departments.
- 2Securing Resources and Human Resource Development:
We will secure the necessary personnel, technologies, and budget, and work to continuously strengthen our cybersecurity measures. Through education and awareness-raising for employees and relevant parties, we will promote improvements in awareness and capabilities.
- 3Risk Management and Incident Response
We will conduct periodic risk assessments and implement measures according to the level of risk. In the event of an incident, we will respond promptly and strive to minimize damage, achieve early recovery, and prevent recurrence.
- 4Supply Chain and External Collaboration
We will collaborate with Group companies and business partners to ensure security throughout the supply chain. We will also strengthen our measures by leveraging the latest information through cooperation with specialized institutions and industry associations.
- 5Factory Cybersecurity
At manufacturing sites in particular, we will implement cyber security measures with a strong emphasis on preventing disasters, including explosions and fires caused by high-pressure gases and large-scale leaks of toxic gases.
- 6Continuous Improvement
Through monitoring and internal audits, we will periodically evaluate the status of our initiatives and pursue continuous improvement in cybersecurity.
Structure and System
Zeon positions cybersecurity as a source of competitive advantage and rebuilt its cybersecurity framework in FY2023. By continuously strengthening this framework, we address cybersecurity risks and seek to ensure business continuity and maintain social trust. The current structure places the Digital Transformation Promotion Division, which oversees cybersecurity, directly under the Representative Director. Under this division, the Digital Security Management & Governance Office has been established. In addition, Zeon has established a Computer Security Incident Response Team (CSIRT) and, in collaboration with external specialist organizations, put in place an incident response framework that operates across the Group.

Promotion of Cyber Security Measures
Zeon has implemented cyber security enhancement measures in three areas—organizational, technical, and human resources—to address rapidly evolving cyber security risks, taking past incidents into account.
- Cyber security risks anticipated by Zeon
-
- Risk of loss of competitiveness due to leakage of confidential information
- Risk of production stoppage due to attacks on control systems
- Risk of business disruption arising from the supply chain
- Organizational Measures
-
- Establishment of an organizational structure staffed by dedicated cyber security specialists
- Approximately fourfold increase in personnel in the Digital Security Management and Governance Department between 2023 and 2026
- Development and company-wide implementation of control rules based on government and industry guidelines
- Updates to cyber security policies and internal regulations in response to regulatory changes and evolving threats
- Technical Measures
-
- Adoption of authentication and access control based on a Zero Trust approach (a model in which no trust is granted even within the network perimeter, and authentication and authorization are performed for all access)
- Implementation of network segmentation and monitoring systems to protect plant control systems
- Establishment of a Private Security Operation Center (PSOC) to monitor information systems and respond to cyberattacks
- Establishment of an incident response framework led by the CSIRT
- Development of a secure development environment
- Human Resources Measures
-
- Annual information security training for all employees
- Incorporation of training effectiveness, as measured by comprehension assessments, into initiatives for the following year
- Training for senior management conducted by external expert instructors
- Targeted email attack drills and analysis of response behavior
- Comprehensive BCP drills based on cyber security incident scenarios
- Recruitment of cyber security specialists
