Toyota made supplier IT a third-party production trust boundary

Summary

Toyota announced on February 28, 2022 that a system failure at Kojima Industries Corporation would suspend 28 lines at 14 plants in Japan on March 1, then announced on March 1 that operations would resume from the first shift on March 2. The primary notices are Toyota's March production plan and resumption notice.
The second-lens accountability issue is not simply "supplier hacked, factory stopped." It is whether a production company can map supplier technology dependencies with enough precision to show which outside systems sit inside the real production control boundary.
Toyota Times later reported that Kojima Industries suffered a cyberattack on February 26, 2022, that all 14 Japanese Toyota plants were halted, and that systems were almost fully restored within a month, in its one-year retrospective.
The record supports a production trust-boundary analysis. It does not support a public attribution of the attacker, a full technical root cause, or a claim that the event began inside Toyota's own core production environment.

A one-day stop can still be a governance event

The short duration of the stoppage can make the incident look small. Toyota's public resumption notice says the sudden shutdown lasted for the March 1 operating day and that all operations would resume from the first shift on March 2. That is a strong recovery outcome, especially when measured against the scale of 28 lines and 14 plants. The accountability signal is not duration alone. It is the fact that a supplier-side technology failure was sufficiently tied to Toyota's production plan that Toyota chose to suspend all domestic lines rather than improvise without reliable ordering and parts-flow assurance.

The February 28 notice identified Kojima Industries Corporation by name, described the issue as a system failure at a domestic supplier, and said Toyota would continue working with suppliers to strengthen the supply chain. That wording is public, bounded, and cautious. It does not disclose the technical details of the supplier's internal environment. It also does not need to do so for the central governance lesson to be visible: the supplier's ability to exchange production information was part of Toyota's practical control surface, even if the technology was not owned by Toyota.

Toyota's public production figures for March 2022 show the company reporting production and sales performance in the ordinary monthly cadence after the incident. Those ledgers are useful because they separate a production interruption from an unbounded catastrophe narrative. The stoppage belongs in the class of continuity events where production evidence, not dramatic language, should drive accountability. The hard question is how a manufacturer proves that the next supplier technology interruption will be isolated, worked around, or escalated before it becomes a full-line stoppage.

Toyota's own explanation of the Toyota Production System emphasizes just-in-time and jidoka as operating principles. Just-in-time reduces waste by delivering only what is needed, when needed, and in the needed amount. That strength also narrows the buffer between a supplier communication failure and a factory decision. A missing part, an uncertain order signal, or an untrusted production status can become a physical-work stoppage. Lean production therefore makes third-party technology evidence more, not less, material.

The supplier boundary was also a production boundary

A conventional ownership map would put Kojima's affected systems on the supplier side and Toyota's plants on the manufacturer side. That map is legally useful, but operationally incomplete. If a supplier's order, monitoring, or coordination platform is needed for Toyota to confirm part availability and sequence production safely, the supplier system forms part of the production trust boundary. It is outside Toyota's corporate perimeter but inside Toyota's practical production dependency.

The best public account of the supplier side is the Toyota Times retrospective, which states that Kojima Industries suffered a cyberattack following unauthorized access to its systems and that the problem affected Toyota because even a single missing component can prevent assembly. That detail matters. A car is not a cloud document that can be saved with one field missing. The physical product has a bill of materials, a sequence, a safety requirement, and a quality record. If a supplier cannot reliably confirm what parts are available, continuing production may increase downstream disorder rather than preserve output.

The accountability issue is therefore not blame transfer. A supplier can be the immediate victim and still be part of the manufacturer's control evidence. Toyota can be outside the first compromised environment and still owe stakeholders a view of how supplier dependencies are classified, monitored, and rehearsed. Factory workers, dealers, and customers are not helped by a perimeter diagram that says the originating failure was elsewhere if the operational result is a plant stop.

The same logic appears in public supply-chain security guidance. NIST's Cybersecurity Supply Chain Risk Management guidance frames cyber supply-chain risk as risk from suppliers, products, services, and practices across the life cycle. CISA's ICT Supply Chain Risk Management materials similarly focus on dependencies that organizations rely on even when another party owns part of the technology. Those references do not adjudicate Toyota's incident. They explain why the incident is properly read as a production trust-boundary problem rather than a supplier-only problem.

The halt criterion was a control, not only a cost

When Toyota suspended all 28 lines at 14 Japanese plants, it likely absorbed cost, schedule pressure, dealer pressure, and customer waiting-time pressure. Yet the stop itself can be understood as a control choice. If the production organization cannot trust ordering and coordination signals, the responsible move may be to stop rather than push uncertain work through a tightly sequenced plant network.

That does not make every future stop acceptable. A halt criterion should be explicit enough that people know when a supplier technology failure crosses from inconvenience into production control risk. What data must be unavailable before production stops? Which part categories have substitute workflows? Which lines can proceed with manual confirmation? Who can authorize a degraded mode? Which safety, quality, and traceability obligations cannot be relaxed? A one-day halt invites those questions because it shows that the threshold was real.

The public record does not show Toyota's internal decision tree. That is an evidence boundary, not a reason to invent one. The available notices show that Toyota publicly named the supplier, named the lines and plants affected, gave the date of suspension, and gave the resumption date. The resumption notice also apologized to customers, suppliers, and related parties. That is useful public notice, but it is not the same as a full continuity-control record.

For accountability, the strongest internal record would show four things: the exact dependency that failed, the production risks considered, the alternative workflows tested, and the reason the one-day stop was safer or more orderly than partial continuation. That record should be available to executives, plant leaders, procurement, supplier managers, and risk committees. It should not require after-the-fact reconstruction from email trails and crisis calls.

Supplier continuity is SME continuity at industrial scale

The target supplier in this event was not a global platform provider with a household consumer brand. Kojima Industries was a domestic supplier of parts, and Toyota's dependence on it illustrates how small and mid-sized enterprise continuity can become industrial continuity. A supplier can be smaller than the manufacturer and still be systemically relevant to a production network.

This is why the event belongs in an SME service-continuity lens. Public cyber guidance often tells smaller firms to back up systems, rehearse recovery, segment networks, and maintain incident contacts. Those steps can sound generic until the supplier is part of a just-in-time production chain. In that setting, backup and recovery are not merely protections for the supplier's own revenue; they become protections for the buyer's production schedule, the dealer's expected delivery dates, and the customer's waiting time.

CISA's Ransomware Guide and NIST's supply-chain guidance are relevant because they shift attention from a single victim to a network of dependency. Japan's Ministry of Economy, Trade and Industry publishes Cybersecurity Management Guidelines that address management-level cyber responsibility, and Japan's Information-technology Promotion Agency provides English information on cybersecurity management guidance. None of those materials say Toyota failed a particular duty in 2022. They show the control vocabulary that a production network should use when supplier technology can halt factories.

The public lesson is that procurement cannot treat supplier cyber resilience as a questionnaire that ends at contract award. The resilience of ordering, communication, monitoring, and recovery paths should be tiered by production consequence. A supplier whose system failure can stop every domestic line should be in a different assurance class from a supplier whose interruption can be buffered, substituted, or rescheduled without full shutdown.

Operator consolidation magnified the dependency

Operator consolidation does not always mean one company owns every dependency. It can also mean one operating method coordinates many plants, suppliers, and workflows so tightly that a single trust break has broad consequences. Toyota's production model is admired because it coordinates work with precision. The Kojima incident shows that precision can carry a common operational dependency when a supplier's technology participates in the ordering rhythm.

The plant count matters here. Toyota's February 28 notice said 28 lines at 14 plants in Japan would be suspended. If the issue had affected one component for one line, the governance problem would still matter, but the operating blast radius would be different. A full domestic halt indicates that the affected supplier-side function intersected with a central decision about whether Toyota could run production confidently across its Japanese plant network.

That kind of dependency should appear in a supplier criticality map. The map should distinguish physical uniqueness, digital dependency, recovery time, substitute availability, manual-workflow feasibility, and customer-facing consequence. A part may be physically small but operationally decisive. A supplier may be financially modest but sequencing-critical. A technology service may look administrative until it is the channel that confirms orders, part status, or delivery timing.

Operator consolidation also raises a governance burden for recovery communication. Once one supplier event can affect all domestic lines, the manufacturer needs one public message, one supplier coordination process, one dealer and customer impact view, and one investor-facing fact pattern. Toyota's public notices did some of that work. The remaining accountability question is whether the internal recovery evidence tied each audience to a concrete control owner rather than to a general "supply chain" label.

Software life-cycle risk reached the factory floor

This event is sometimes described as a cyberattack on a supplier, but the broader risk is software life cycle and lock-in. Production networks rely on order systems, file stores, communications channels, engineering data, shipment confirmations, and monitoring tools. Those systems need patching, access review, backup, replacement planning, and dependency mapping in the same way customer-facing software does.

Software life-cycle risk becomes visible when a legacy or supplier-managed system lacks a tested fallback. If the only trustworthy path for an order signal is the affected platform, recovery depends on that platform's restoration. If manual procedures exist but are not tested at production speed, they may not provide meaningful continuity. If the buyer does not know which supplier software versions, credentials, interfaces, and recovery time targets support critical parts, the dependency is hidden until failure.

NIST's Secure Software Development Framework and CISA's Secure by Design program are not Toyota-specific. They matter here because the factory floor increasingly depends on software assurance beyond the manufacturer's direct code base. A supplier's order platform, remote-access method, and recovery tooling can be just as operationally significant as a production robot or plant control panel.

The most useful lesson is not that Toyota should own every supplier system. That would be unrealistic and could create new fragility. The lesson is that Toyota should know which supplier systems are production-critical, which recovery evidence is contractually and operationally required, and which alternate workflows have been exercised under realistic timing constraints. Ownership is less important than tested control.

Public notice and recovery evidence are different products

Toyota's public communication was concise. It named the supplier, the lines, the plants, the date, and the resumption plan. That was appropriate for an immediate production notice. A public notice should not expose supplier technical details that would increase risk or compromise an investigation. But concise public notice should sit on top of richer recovery evidence.

Recovery evidence should answer whether the affected supplier restored systems from trusted backups, rebuilt compromised services, changed credentials, validated file integrity, confirmed order queues, and tested communication channels with Toyota before resumption. It should also answer whether Toyota changed its own supplier monitoring after the incident. The public record does not provide those details. The absence of public detail should not be converted into accusations. It should be treated as a boundary around what outside observers can responsibly claim.

Toyota Times' retrospective provides a valuable later view: Kojima employees worked to minimize damage, Toyota's shutdown lasted only one day, and systems were almost fully restored within a month. That tells us the immediate production recovery was fast and the wider restoration took longer. The gap between production resumption and fuller restoration is exactly where accountability evidence belongs. A plant can restart while some supplier systems remain in controlled recovery, but that condition should be governed, documented, and monitored.

For a manufacturer, the strongest accountability posture is to show that resumption is not merely "systems are back." It is a decision supported by integrity checks, supplier attestations, manual confirmations, and line-level risk acceptance. For a supplier, the strongest posture is to show containment, recovery, and communication. For customers and dealers, the strongest posture is a clear statement of what changed about production and expected delivery.

The incident should not be over-attributed

The timing of the Kojima incident, soon after Japan joined sanctions against Russia following the invasion of Ukraine, generated public speculation. Some coverage noted the geopolitical context. The public record available for this article does not establish state involvement or a motive. Toyota's notices did not attribute the event to a state or criminal group, and Toyota Times described unauthorized access and a cyberattack without naming an actor.

This boundary matters because accountability analysis can be weakened by dramatic attribution when practical control evidence is stronger. Whether the actor was criminal, state-linked, opportunistic, or otherwise, the production accountability questions are similar: which supplier systems were critical, how were they protected, how were they recovered, what did Toyota know, and how quickly could the production network make trustworthy decisions?

Avoiding over-attribution does not minimize the event. It makes the analysis more useful. A manufacturer cannot control the identity of every attacker. It can control supplier criticality ranking, recovery requirements, communication protocols, alternate workflows, and evidence review. A supplier cannot control every external threat. It can control backups, access hygiene, logging, patching, rehearsals, and timely escalation.

The cleanest public formulation is therefore: Kojima Industries suffered a cyberattack, Toyota halted all domestic plants for one day because of the supplier-side system failure, Toyota resumed operations the next day, and the event revealed that supplier technology can be part of the manufacturer's production control boundary. That formulation is evidence-led and avoids unsupported claims about motive or full technical root cause.

What practical control looked like

Practical control starts with mapping. Toyota would need to know which suppliers provide parts that cannot be substituted quickly, which supplier systems exchange production instructions or confirmations, and which plants are affected by each supplier. The February 28 notice shows Toyota could identify the line and plant scope for the immediate halt. The governance question is whether that scope was already mapped before the incident or reconstructed during it.

The next control is halt authority. Someone had to decide that all affected operations would stop on March 1 and resume on March 2. That decision likely required input from procurement, production control, plant operations, supplier management, and executives. A resilient operating model should predefine who owns that decision, what evidence they need, and how they communicate with stakeholders.

Substitute ordering is a third control. If a supplier is unavailable, the manufacturer needs to know whether another supplier can supply the same part, whether inventories can be rebalanced, whether production can be resequenced, and whether quality records can support the substitution. The available public record does not say substitute workflows were unavailable; it only shows Toyota chose a full one-day halt. That choice may have been the most responsible path given the facts known at the time.

Supplier recovery proof is the fourth control. The supplier should be able to provide evidence that restored systems are trustworthy enough for production decisions. That evidence should include clean backups, changed credentials, malware removal or rebuild, validated communications, and clear residual-risk statements. The buyer should not have to accept "we are back online" as sufficient when the buyer's factories are the downstream consequence.

Customers and workers carried the visible harm

The immediate public harm was production interruption, inconvenience to customers and suppliers, and uncertainty for workers and dealers. Toyota apologized to relevant suppliers and customers in both public notices. The one-day duration limited visible harm, but a short halt still affects shift planning, transport schedules, dealer expectations, and customer delivery timelines.

The incident also created investor and governance questions. A production network that can stop from a supplier technology failure is not merely facing cyber risk; it is facing operational-control risk. Investors do not need every technical detail to understand that supplier resilience can affect output. The monthly production and sales figures provide after-the-fact production context, but they do not replace continuity evidence about the dependency.

For factory workers, the control question is concrete. Are they being sent home because the line lacks parts, because the part status cannot be trusted, because the sequencing signal is unavailable, or because the manufacturer is protecting quality and safety? Different reasons imply different recovery actions. Workers and line managers deserve a control explanation, even if it is delivered internally and not in public technical detail.

For customers, the issue is trust in delivery commitments. A buyer waiting for a vehicle may not care whether the disruption came from a supplier server, a shipping lane, a semiconductor shortage, or a plant issue. The manufacturer's accountability is to convert the cause into clear expectations, recovery actions, and evidence that the same single point will not repeatedly break delivery promises.

What a mature supplier trust-boundary program would show

A mature program would classify supplier systems by production consequence. Tier one would include systems whose failure can stop a plant, a product family, or the full domestic network. Tier two would include systems with short-term workarounds. Tier three would include systems whose loss affects administration but not production. The Kojima event belongs in the first category because the outcome affected 28 lines at 14 plants.

Each tier should have different control requirements. For the most critical systems, requirements should include tested backups, identity controls, endpoint protection, network segmentation, incident notification timelines, alternate communication channels, production-data reconciliation, and tabletop exercises involving both supplier and manufacturer. The NIST Cybersecurity Framework and NIST supply-chain guidance provide a vocabulary for organizing those capabilities, though the manufacturer must translate them into plant-level decisions.

Contracts alone are limited public evidence. A contract can say the supplier will maintain security and continuity, but the production network needs proof. Proof can include exercise results, recovery-time evidence, contact trees, secure file-transfer validation, manual ordering drills, and exception reporting. The strongest evidence is not a questionnaire score; it is a rehearsed ability to keep safe production decisions moving when the primary supplier system is impaired.

The buyer also has duties. Toyota's supplier management should avoid pushing impossible requirements onto smaller suppliers without support. If a smaller supplier is production-critical, the manufacturer may need to help define secure interfaces, shared exercises, escalation paths, and continuity funding. The accountability lens is shared because the production dependency is shared.

Evidence should survive outside the crisis room

The most important post-incident artifact is not a press release. It is a durable record of the trust boundary that made the stoppage possible. Toyota's current information security page describes a group-wide approach to protecting information assets and strengthening security from multiple perspectives. That current posture cannot be projected backward as proof of every 2022 control. It is useful because it shows the kind of enterprise-level language that must connect to supplier continuity, not remain separate from manufacturing operations.

Toyota's Integrated Report 2022 is also relevant for context because it describes Toyota's value-creation model, mobility-company transition, and software-related development work. An annual report is not a forensic account of the Kojima incident. It does, however, show that Toyota's operating environment was already becoming more software-mediated at the same time that physical production still depended on tightly sequenced suppliers. The more software participates in vehicles, logistics, engineering, and plant coordination, the less useful it becomes to separate "IT risk" from "production risk."

Toyota's Sustainability Data Book 2022 adds another lens: supply-chain governance is already part of how the company explains environmental, social, and governance obligations to specialists and stakeholders. Cyber continuity should be treated with the same discipline. It should have defined scope, evidence, escalation, and progress measures. A supplier interruption that stops plants is not just an operational anecdote; it is a sustainability and resilience issue because it affects workers, customer commitments, supplier stability, transport planning, and economic continuity.

The United States government's NIST Small Business Cybersecurity Corner is not Toyota-specific, but it is useful for the SME part of the analysis. It recognizes that smaller organizations need practical security resources. When a large manufacturer depends on a smaller supplier, the buyer should not assume that ordinary supplier size maps neatly to ordinary supplier consequence. A supplier can be a smaller business and still carry a production-critical digital role. That mismatch is where shared assurance should begin.

CISA's critical infrastructure security and resilience materials also help frame the public-interest dimension. Automotive manufacturing is not the same as emergency medicine or electric power, but large production networks still support employment, logistics, transport availability, and regional economies. When one supplier technology event can idle many plants, resilience evidence should be good enough for more than a narrow vendor-management file. It should be legible to operations leaders who must decide whether to run, stop, or restart.

Those external references point to a practical standard for the next event. The record should show pre-incident classification, not only post-incident discovery. It should show whether the supplier was known to be production-critical; which systems carried ordering, production monitoring, or logistics truth; which alternate channels were tested; which plant decisions depended on supplier confirmation; and which executives owned the stop-or-continue threshold. The record should also show which control gaps were closed after recovery, because the value of a short outage is lost if the organization only celebrates speed.

Evidence should be layered. Plant teams need a runbook that says what to do when part status cannot be trusted. Procurement needs a supplier-criticality file that connects contract terms to actual recovery tests. Cyber teams need a technical handoff that identifies affected services, credential actions, rebuild evidence, and residual risk. Finance needs a production-impact view that separates lost output, deferred output, extra logistics cost, and customer consequence. Communications teams need public facts that are specific enough to be accountable but not so detailed that they increase risk.

The Toyota-Kojima case is therefore a useful discipline test. It asks whether supplier cyber continuity is governed as a living production dependency or as a contractual promise. It asks whether the manufacturer can pause production responsibly and then explain why resumption is trustworthy. It asks whether suppliers receive enough support and clear enough requirements to meet the consequence of their role. Above all, it asks whether the boundary between lean manufacturing efficiency and third-party technology fragility is visible before the line stops.

There is also a board-level test. A director or executive should be able to ask for the top supplier technology dependencies that can stop production, the last date each dependency was exercised in degraded mode, the maximum tolerable interruption, the recovery owner on both sides of the relationship, and the evidence that a restart decision would be based on integrity rather than hope. That list should be short enough to govern and detailed enough to act on. If the answer is only a broad supplier-risk rating, the organization has not converted the incident into control knowledge.

A plant-level test is different but equally concrete. Supervisors should know which signals become untrusted during a supplier technology failure, which manual confirmations are acceptable, which quality checks must be repeated, which parts cannot be substituted, and how the line communicates a stop, partial restart, or full restart. Those instructions do not need to expose sensitive supplier security details. They need to tell people how to make safe production decisions when the normal information path is impaired.

A supplier-level test completes the chain. The supplier should know which buyer contacts receive urgent notice, what minimum facts must be sent, how often status is refreshed, which alternate channels are preapproved, and which recovery evidence is needed before the buyer can rely on restored production signals. That is not punitive oversight. It is shared operating discipline for a dependency that both companies benefit from in normal conditions and both companies must protect during failure.

Why the event remains distinct from ordinary supplier disruption

Manufacturing firms face earthquakes, storms, parts shortages, labor disruptions, logistics breakdowns, and quality holds. The Toyota-Kojima event belongs beside those continuity risks, but it is distinct because the triggering weakness was a technology trust boundary. The physical product was not necessarily defective. The delivery route was not necessarily blocked. The problem was confidence in the information and coordination path that allowed production to proceed.

That distinction changes the evidence needed for recovery. After a flood, the question may be whether the facility and inventory are physically available. After a quality defect, the question may be whether parts meet specifications. After a supplier technology incident, the question is whether orders, files, messages, credentials, and production status are trustworthy. The recovery standard is not just availability; it is integrity.

The source set supports this reading. Toyota's notices show production impact and resumption. Toyota Times adds the cyberattack and recovery narrative. Supply-chain security guidance from NIST, CISA, METI, and IPA explains why third-party cyber resilience is a management problem. Toyota's production-system page explains why just-in-time can amplify uncertainty in parts flow. Together, those sources support a second-lens analysis without retelling the same old "cyberattack stopped Toyota" headline.

The accountable outcome is a boundary map. It should show where Toyota's production control depends on external technology, where the supplier's duty begins, where Toyota's verification duty begins, and where workers, dealers, and customers receive continuity information. A boundary that no one can see in advance will be discovered only when it breaks.

Typography and evidence presentation

Supplier-risk evidence must be legible because the audience is mixed: plant leaders, supplier executives, procurement staff, cyber teams, safety teams, lawyers, finance leaders, and public communicators all need to understand the same event at different depths. A cryptic control report can leave production leaders uncertain; an oversimplified public narrative can leave suppliers with no path to improve. The following typography block is included because readable presentation is part of accountable risk communication.

Typography is the art and technique of arranging type to make written language legible, readable, and visually appealing. It involves selecting typefaces, point sizes, line lengths, line-spacing, and letter-spacing.

Typography originated with the invention of movable type by Johannes Gutenberg in the 15th century.
Key elements include font selection, kerning, tracking, and leading.
Good typography enhances readability and conveys mood or tone in design.

For a supplier trust-boundary record, readable evidence means simple control maps, dated recovery logs, clear escalation ownership, and plain statements about what is known, what is unverified, and what has changed. If the record is too technical for plant leaders or too vague for security teams, it will fail both audiences. The Toyota incident is a useful case because its public facts are sparse but the accountability questions are concrete.

Accountability by practical control

The attacker or unauthorized actor controlled the intrusion into Kojima's systems. Public sources do not identify the actor, motive, or full method. Responsibility for unauthorized access remains with whoever conducted it.

Kojima Industries controlled the affected supplier environment, its recovery actions, its internal communications, and its evidence to Toyota. The public record does not justify a complete judgment on Kojima's preparedness. It does justify saying that a supplier's technology resilience became material to Toyota's production continuity.

Toyota controlled the production halt, the public notice, the resumption decision, supplier coordination, and the future classification of supplier technology dependencies. Toyota did not need to own the compromised supplier environment for the event to become a Toyota accountability issue, because Toyota's plants, customers, suppliers, and investors absorbed the operational consequence.

Regulators and public guidance bodies controlled the wider management language. NIST, CISA, METI, and IPA provide frameworks for supply-chain cybersecurity and management responsibility. Their role is not to score Toyota's incident after the fact; it is to give manufacturers and suppliers a control vocabulary before the next interruption.

Customers and workers controlled very little. They could not inspect Kojima's systems, choose alternate ordering channels, or set Toyota's halt threshold. They were downstream of decisions made by supplier and manufacturer control owners. That asymmetry is the reason the event belongs in a risk and accountability record.

The durable lesson

Toyota recovered quickly, and quick recovery matters. But the incident's lasting value is not speed alone. It is the visibility of a hidden trust boundary between supplier technology and manufacturer production. A supplier's system failure was enough to stop all domestic Toyota lines for a day. That is the kind of dependency that must be known before it fails, not discovered during a crisis.

For manufacturers, the action is to turn supplier technology dependencies into an operating map. For suppliers, the action is to treat cyber resilience as production reliability, not back-office hygiene. For procurement, the action is to buy continuity evidence, not only parts. For executives, the action is to ask which third-party systems can stop production and what proof exists that each one can fail without forcing a full stop.

The event should be remembered in measured terms: a short production halt, a named supplier, a fast resumption, and a clear signal that lean manufacturing creates a shared control surface. Toyota's strength in coordinated production makes the trust-boundary question sharper. The more precise the system, the more accountable the dependency map must be.

Typography

Typography originated with the invention of movable type by Johannes Gutenberg in the 15th century.
Key elements include font selection, kerning, tracking, and leading.
Good typography enhances readability and conveys mood or tone in design.