## IT Strategy and Information Security 

The Daiwa Securities Group aims to provide customers with high value-added products and services quickly, precisely, and reasonably priced. To this end, it uses IT strategically. As an active participant in the financial and capital markets, the Group possesses information resources, including personal information. In order to protect these information resources from outside threats, the Group is working to maintain and improve the level of its information security. 

## IT Strategy 

## <IT Governance System> 

The Group has established the Group IT Strategy Committee as a subcommittee of the Executive Management Committee. This committee deliberates and makes decisions on such issues as budgets for IT investment and the allocation of IT functions. In regard to IT investment planning, the Group IT Strategy Commit- tee rigorously selects the IT investments necessary for the Group and allocates budgets based on the strategic importance of each investment. 

Additionally, the Group IT Strategy Committee is strengthening Group IT governance by primarily bolstering the management and control function in connection with managing systems construction projects within the Group. 

## <IT Strategy> 

The Group strategically uses IT to achieve its main goal of improv- ing its competitive edge while maintaining the effectiveness of con- trol over the quality and costs of system services. In FY2011, management and control over IT-related budget execution was strengthened, along with the construction of a new infrastructure system for online trading and systems that were adapted for the consolidation of securities subsidiaries (the merger of Daiwa Securities Co. Ltd. and Daiwa Securities Capital Markets Co. Ltd.). 

Starting FY2012, the Group, aiming for sustainable growth, will begin promoting the two IT strategies (basic IT policies) of “raising the cost competitiveness of business infrastructures through reconstruction,” and “strengthening IT governance” under its “new” Medium-Term Management Plan “Passion for the Best” 2014. In accordance with the plan, the Group will re-examine both the functions and scale of existing business infrastructures and reconfigure them so as to enable the “new” Daiwa Securities to provide services more efficiently in both the retail business and wholesale business. 

## Information Security 

## <Measures for Maintaining Information Security> 

In order to fulfill its social responsibility as an active participant in the financial and capital markets, as well as gain the trust of cus- tomers, the Group has adopted a full spectrum of information security policies at companies throughout the Group to ensure that important personal information received from customers and all other information resources are managed in a secure and appropri- ate manner. 

Among the organizational measures that we have adopted is the Information Security Group Minimum Standard, which dictates the basic rules that all companies in the Group must adopt for handling information. In addition to introducing these information security rules at each company, we have appointed a “Chief Infor- mation Security Officer” at each Group company to oversee infor- mation management activities. 

A variety of technical and structural measures have also been introduced to enhance security and ensure that Group information resources are managed appropriately, such as office automation through the use of thin clients and high-security access controls at the data center. The online trading systems of Daiwa Securities Co. Ltd. employ highly advanced encryption technology for data trans- mission and for user ID verification, thereby ensuring that clients are able to use the system safely and securely. 

## <Efforts to Enhance the Level of Information Security> 

The Group has put in place a self-assessment scheme for employ- ees in order to maintain and build upon the current level of informa- tion security across the Group as a whole. Each Group company has formulated further initiatives tailored to meet the information security needs of the products and services they offer. 

Additionally, in recognition of the importance of human factors in effective information security systems, the Group has introduced training programs to educate all executives and employees in the basics of information security. The programs are offered periodically as group training sessions, as well as through e-learning. 

