Japan’s Supply Chain Security Rating (SCS): ★3 and ★4
A Japanese customer emails your plant in Chennai, Rayong, or Ohio: "Please confirm you can meet ★3 requirements," or "We ask all key suppliers to implement ★4-level measures." The stars refer to a new Japanese government cybersecurity rating for supply chains. Official English documents have not been published yet, so this guide explains what the rating is, whether it is mandatory, and what your IT, quality, and purchasing teams can do now.
The scheme is officially called the Supply Chain Security Assessment Program (SCS-AP). In Japanese it is the SCS hyoka seido (SCS evaluation system), and many English summaries call it the SCS rating. Everything here reflects what Japan's Ministry of Economy, Trade and Industry (METI) and IPA, the government agency that runs the scheme, had published as of the end of September 2026.
The short version:
- SCS is a voluntary rating, not a law. Whether you need a star is decided by your contract with the customer.
- Two levels are defined so far: ★3 (26 requirements, self-assessment checked by a registered security expert, valid 1 year) and ★4 (43 requirements, third-party evaluation, valid 3 years). ★5 is still under study.
- It covers corporate IT, not factory control (OT) systems.
- IPA plans to open applications in March 2027, and will revisit the date if preparations slip.
Contents
- What Is Japan's SCS Rating?
- Is SCS Mandatory, and Does It Apply Outside Japan?
- What It Covers: Corporate IT, Not Factory Control Systems
- ★3 vs. ★4 vs. ★5
- How SCS Maps to Frameworks You Already Use
- What ★3 Requires in Practice
- What ★4 Adds
- From Self-Assessment to Registration: Steps, Timeline, and Fees
- Which Level Will Your Customer Ask For?
- Paying for It: What to Know Before Price Talks with Japanese Customers
- What You Can Do Now
- Questions to Ask Your Japanese Customer
- Limits of This Guide
- FAQ
- Sources
What Is Japan's SCS Rating?
The SCS (Supply Chain Security) scheme shows how far a company has implemented security measures, using shared criteria and graded levels marked with stars. METI and the Cabinet Secretariat's National Cybersecurity Office set the policy, and IPA runs the scheme day to day. IPA was known in English as the Information-technology Promotion Agency until June 2026, when it became the Innovation Platform Agency, Japan; the abbreviation stayed the same.
The scheme's framework document is the Policy for Building the Scheme (seido kochiku hoshin), published on March 27, 2026. It followed an interim report in April 2025 and a draft policy on December 26, 2025. The draft drew 569 public comments from 93 parties, and the March 2026 document is the final version, not a draft.
The driver is the rise in cyberattacks that enter through suppliers. If one parts maker's systems go down, its customer's production line can stop too. The policy names three risks: supply disruption, leakage or tampering of confidential information, and intrusion that uses a supplier as a stepping stone.
Today, each Japanese customer sends its own security checklist, with different formats and questions, and suppliers answer them again and again. Figure 1 shows what the scheme is meant to change on each side.
The goal is one shared yardstick that saves work on both sides.
Based on METI's Policy for Building the Scheme (March 2026).
Two points are easy to miss. First, SCS is not a ranking: the policy states that it does not aim to make companies compete on security levels.
Second, a star shows that a company met the criteria when it earned or renewed it. It does not guarantee complete security.
Is SCS Mandatory, and Does It Apply Outside Japan?
No law requires a star. METI's FAQ calls SCS a voluntary scheme that imposes no regulation of its own. Whether a star becomes a condition of business is up to the contract between the buyer and the supplier.
On April 27, 2026, METI and the National Cybersecurity Office issued a warning about sales pitches claiming that "companies without a rating will be barred from doing business." The scheme itself restricts no transactions. The FAQ also notes that "launch" means applications open: no company holds a star on that day, and companies are not all required to have one from that date.
For suppliers that cannot get a star right away, METI suggests customers can use the requirements and criteria as a common checklist instead. So a customer may ask you to self-check against the ★3 list instead of registering.
Whether overseas subsidiaries or non-Japanese companies can apply is not addressed in the official materials published as of September 2026. The METI policy says applications are made by legal entity (or sole proprietor) as a rule. With a registered expert (★3) or an evaluation body (★4) confirming the scope, a company can also apply for a business unit or a whole group.
IPA's FAQ says English versions of the scheme documents and the ★3/★4 requirements will be published before the scheme starts. Until then, ask IPA or your customer whether your site can apply on its own, or whether it should be covered under your Japanese parent's group scope.
What It Covers: Corporate IT, Not Factory Control Systems
Manufacturers usually ask first whether production equipment will be assessed. It will not: SCS covers the company's IT infrastructure, and factory control (OT, operational technology) systems are not directly in scope. OT means the control systems that run equipment and lines.
IT infrastructure includes mail and web servers, authentication systems, business PCs and smartphones, and cloud services. It also includes the firewalls, routers, and VPN appliances that connect the company to the outside world.
The policy does not mention ERP by name. In our reading, though, core systems such as an ERP that handles orders and inventory count as "servers that make up the IT infrastructure common to the whole business," so they fall inside the scope. Confirm the actual boundary in the scope guidance that IPA's upcoming explanatory guide will include.
Figure 2 summarizes what is in and out of scope.
Office IT and its boundary with the outside world are in scope. Factory control systems and products are handled under other frameworks.
Based on the scope section of METI's Policy for Building the Scheme.
Out of scope does not mean ignored: PLCs and other control equipment, and production networks, are expected to follow separate guidance. In Japan that means METI's Cyber/Physical Security Guidelines for Factory Systems. In the auto industry, the JAMA/JAPIA guidelines added a factory-domain edition in April 2026.
Watch for office networks that connect to factory networks. Smart-factory projects that send equipment data up to business systems create exactly this link. In that case, the scheme expects you to restrict traffic between the two to what is actually needed.
★3 vs. ★4 vs. ★5
Only ★3 and ★4 have been defined in detail. ★5 exists as a placeholder, and its content will be worked out from Japan's fiscal 2026 (April 2026–March 2027) onward. Figure 3 compares the two defined levels.
Beyond the number of requirements, the two levels differ in who evaluates and how long the star lasts.
Fees apply to applications through March 31, 2028, tax included (IPA, September 18, 2026). They do not include fees for the expert's review or the evaluation body. USD figures are rough conversions at about JPY 155 per dollar; actual rates vary.
★3: Self-Assessment Checked by a Registered Expert
★3 targets resistance to common attacks that exploit well-known vulnerabilities. Your company assesses itself against 26 requirements, and a security expert reviews the result. The star is valid for 1 year, and you renew it each year with a new expert-reviewed self-assessment.
The expert cannot be just anyone in your IT department. They must hold one of these credentials and complete the scheme's training before being registered:
- Registered Information Security Specialist (Japan's national RISS qualification)
- Certified Information Security Auditor (Japan)
- CISSP, CISM, or CISA
- ISO/IEC 27001 lead auditor
If no one in-house qualifies, you would hire an outside expert. Registration of experts is planned from January 2027. Where those experts can be based, and whether they can work in English, has not been announced.
★4: Third-Party Evaluation
★4 goes beyond keeping attackers out. It also covers limiting the damage after an intrusion and protecting customers' data and systems. An evaluation body designated by IPA's designation committee assesses 43 requirements.
The evaluation has three parts:
- Document review of your policies and records
- On-site audit, with interviews and checks of rules and system settings on screen
- Technical testing, including vulnerability scans of internet-facing equipment such as VPN appliances and routers
The policy expects each part to take about 1–2 days, not counting preparation and report writing. Because each level includes the one below it, you can go straight to ★4 without holding ★3 first.
★5: Still to Be Defined
★5 is meant for advanced attacks, including unknown ones. The direction is to build a risk-based management system like ISO/IEC 27001 first, then implement current best-practice controls in your systems. It is expected to use third-party evaluation, but the number of requirements, validity period, evaluation details, and start date are all still undecided.
How SCS Maps to Frameworks You Already Use
If your company already works with NIST, ISO/IEC 27001, or automotive security rules, much of SCS will look familiar. This section shows where it fits.
SECURITY ACTION: ★1 and ★2
SCS starts at ★3 because ★1 and ★2 already exist in IPA's SECURITY ACTION, a program in which small and mid-sized companies declare that they are working on information security. One star means working on IPA's six basic security measures (joho security 6-kajo). Two stars means doing a self-check, then setting and publishing a basic security policy.
Each step up moves from self-declaration toward third-party evaluation, with stricter checks.
ISMS certification (ISO/IEC 27001) is positioned as "complementary" to ★3 and ★4.
NIST CSF 2.0: Six Functions Plus Supplier Management
The requirements are grouped into seven categories: the six functions of the US NIST Cybersecurity Framework (CSF) plus supplier management. IPA's requirements spreadsheet labels the categories with the matching CSF functions. CSF 2.0 already handles supply chain risk inside its Govern function, but SCS pulls supplier management out as a category of its own.
Figure 5 shows our count of requirements per category, based on the requirements list dated March 27, 2026.
"Protection" has the most items: IDs, passwords, updates, and backups.
Our count from IPA's "★3/★4 Requirements and Evaluation Criteria" (March 27, 2026 version). ★4 counts include the ★3 items. Totals are 26 for ★3 and 43 for ★4, matching the METI policy. Category names are our translations.
ISO/IEC 27001: Complementary, Not a Substitute
An ISO/IEC 27001 (ISMS) certificate does not give you a star automatically. The two take different approaches. ISMS certifies that your organization runs a working system for assessing its own risks and choosing its own controls.
★3 and ★4 take a baseline approach instead: the scheme fixes in advance a set of controls that work against common threats. The policy presents this as making it easier to know what to do. Existing ISMS documents may help, but an ISMS-certified site still needs to check each SCS criterion item by item.
JAMA/JAPIA Cybersecurity Guidelines: Lv1 and Lv2
Auto suppliers may already know the cybersecurity guidelines issued jointly by the Japan Automobile Manufacturers Association (JAMA) and the Japan Auto Parts Industries Association (JAPIA). The latest version is V2.3, and JAMA publishes English materials. If you supply the Japanese auto industry, you may already have filled in its self-assessment checklist.
The METI policy says ★3 corresponds to the guidelines' Lv1 and ★4 to Lv2. How the two will be linked in practice is still under discussion with JAMA and JAPIA. Lv1/Lv2 work may help as a starting point, but do not assume it converts to a star.
Similar Schemes in Other Countries: CMMC, TISAX, Cyber Essentials
The METI policy itself compares SCS with three foreign schemes built on a similar idea of graded supplier security. The table below summarizes that comparison for orientation only. These schemes are separate, and holding one does not satisfy another.
| Scheme | Run by | Main target | How it is assessed |
|---|---|---|---|
| SCS (Japan) | METI, National Cybersecurity Office; operated by IPA | Companies in business and IT service supply chains, any industry or size | ★3: expert-confirmed self-assessment; ★4 and ★5: third-party evaluation |
| CMMC 2.0 (US) | US Department of Defense | Defense Industrial Base contractors | Level 1: self-assessment; Level 2: third-party or self, depending on the information handled; Level 3: government (DIBCAC) assessment. Requirements drawn from NIST SP 800-171 and related sources |
| TISAX (Europe) | German Association of the Automotive Industry (VDA) | Automakers and their suppliers | Audit by an assessment provider. Requirements based on ISO/IEC 27001 and related standards, plus prototype and data protection |
| Cyber Essentials / Plus (UK) | UK National Cyber Security Centre (NCSC) | All organizations based in the UK | Cyber Essentials: self-assessment checked by a certification body; Plus: technical verification |
Source: comparison table in METI's Policy for Building the Scheme (March 2026). The policy also says Japan will keep studying possible mutual recognition with Cyber Essentials. The policy does not describe any mutual recognition arrangement already in place.
What ★3 Requires in Practice
Each requirement has several more detailed evaluation criteria under it. Reading the ★3 criteria, most items ask you to write down rules, keep inventories, and review them once a year, rather than to buy special equipment. Typical examples:
- Define the roles and responsibilities of the executive in charge of security and the security department, and keep a contact list.
- Track the maker, OS, and number of PCs and servers, and the maker, model, and maintenance contractor of network devices.
- Issue, change, and delete IDs only through a request-and-approval process, and promptly disable IDs no longer needed, such as those of employees who have left.
- Always use multi-factor authentication for cloud services that hold important confidential information.
- Apply updates that fix severe vulnerabilities within 14 days of release.
- Define what is backed up, how often, and for how long, and keep written restore procedures.
- Change default passwords on firewalls and routers, and delete unneeded traffic rules.
- Set incident-response steps and internal and external contacts, and run training and drills at least once a year.
Some criteria include hard numbers. Passwords must be at least 8 characters if you use multi-factor authentication or lock accounts after 10 failed attempts. Without either, they must be at least 10 characters and include uppercase letters, lowercase letters, and numbers.
The 14-day patch rule covers updates that fix vulnerabilities the vendor rates Critical or High Risk, or that have a CVSS (Common Vulnerability Scoring System) base score of 7.0 or higher. It also covers updates where the vendor gives no severity details.
What ★4 Adds
★4 adds 17 requirements and stacks extra criteria onto existing items. The additions fall into three themes: management with executive involvement, detection and logging that assume an intruder may already be inside, and oversight of your own suppliers.
- Report the security plan to the executive in charge at least once a year and get it approved.
- Review the security status of key suppliers and subsidiaries at least once a year.
- Define sources, frequency, and handling steps for vulnerability information, and check monthly for anything missed.
- Keep firewall, proxy, and authentication server logs for 6 months, and review authentication logs at least monthly.
- Record entry to and exit from server areas, and set rules for bringing in and taking out external storage media.
- Give security training to all staff, including executives, at least once a year.
- Confirm that systems can be restored from backup within the target time.
This supplier item is the one most likely to reach overseas plants. A company that earns ★4 takes on the job of checking the security of its own key suppliers and subcontractors. Requests are expected to cascade from tier 1 suppliers asked for ★4 down to tier 2 and tier 3, which can include your plant even if you never deal with the Japanese end customer directly.
METI has repeatedly said that no specific security product is required. The criteria do not name products such as EDR (endpoint detection and response), so each company can choose how to meet them based on its size and system setup.
At IPA's operating council meeting on September 11, 2026, members agreed to make minor revisions to the requirements and criteria. As of the end of September 2026, IPA's site still showed the March 27 version, and an explanatory guide was still to come, so check for the latest version before you self-assess.
From Self-Assessment to Registration: Steps, Timeline, and Fees
Both levels share the same first steps up to self-assessment, then split by who reviews the result. To pass, you must in principle meet every evaluation criterion. If a gap is found, you can still earn the star once you fix it and the fix is accepted.
Set the scope, assess yourself, get reviewed or evaluated, then apply to IPA for registration.
Based on METI's Policy for Building the Scheme and IPA operating council materials (September 11, 2026). Detailed procedures will appear in IPA's registration application guide.
The checks continue after you earn a star: for ★3, you resubmit an expert-reviewed self-assessment every year. For ★4, you send a self-assessment to the evaluation body each year during the 3-year validity period. If your plant already runs ISO 9001 internal audits, this annual check of whether your rules are actually followed will feel familiar.
Timeline: Applications Planned From March 2027
Official wording on the start date shifted over time. The March 2026 policy aimed for launch in the second half of Japan's fiscal 2026 (October 2026–March 2027), and METI's press release said around the end of Japan's fiscal 2026, which ends in March 2027. On September 11, 2026, IPA's operating council agreed to announce that IPA plans to start taking applications in March 2027.
IPA's fee notice of September 18 also says IPA plans to start accepting applications in "March 2027 or later." If publishing the guides or designating evaluation bodies falls behind schedule, the start date will be reviewed. Figure 7 separates what had been published from what was still planned as of September 2026.
Published items versus planned milestones, as of the end of September 2026.
Plan from IPA operating council materials (September 11, 2026). The start date will be reviewed if preparations fall behind.
You can start before applications open. IPA's materials expect companies to self-assess once the guides are out, then choose experts or evaluation bodies from January 2027. ★4 third-party evaluations are expected to begin in February 2027.
Fees: Only Registration Fees Are Public
IPA's registration fee, announced on September 18, 2026, is JPY 10,000 (about USD 65) for ★3, covering 1 year, and JPY 60,000 (about USD 390) for ★4, covering 3 years. Both include tax. For ★3 applications from April 1, 2028, the fee rises to JPY 20,000 (about USD 130).
These fees only pay for listing in IPA's register. No official figures exist yet for an external expert's review, a ★4 evaluation, or the security work itself.
Providers' prices should become clearer after evaluation bodies and experts are announced from late 2026. USD amounts here are rough conversions at about JPY 155 per dollar.
Which Level Will Your Customer Ask For?
Once the scheme starts, Japanese buyers will tell suppliers things like "please obtain ★3" or "please implement ★4-level measures." In Japanese, the second form often uses sōtō ("equivalent to"), as in ★4 sōtō. Confirm whether your customer means registering a star or meeting the criteria.
The policy gives two example tests for choosing a level:
- Business continuity risk: would a stoppage at this supplier cause unacceptable delays to the buyer's critical operations?
- Information management risk: can this supplier access the buyer's critical confidential information or systems?
If either applies, the example points to ★4; if neither does, ★3. For a parts maker, that means a supplier of hard-to-replace custom parts, or one that holds customer drawings and specification data for machining, may be asked for ★4.
On the other hand, the policy suggests buyers may leave out one-off purchases and low-importance purchases of easily replaced items, such as off-the-shelf goods. For purchasing teams, the practical effect is a new security line on the supplier evaluation sheet.
Paying for It: What to Know Before Price Talks with Japanese Customers
Suppliers naturally ask who pays for the work. METI and the Japan Fair Trade Commission (JFTC) addressed this in a joint document on building partnerships with suppliers to improve supply chain cybersecurity. It says that asking suppliers to take security measures is not, by itself, a problem under Japan's Antimonopoly Act.
Depending on how it is done, though, such a request can become abuse of a superior bargaining position. The document lists three practices that buyers in a stronger position should avoid.
Cautions for buyers, from the METI and JFTC document.
Whether a specific transaction violates the law is judged on its actual facts.
On December 26, 2025, METI and the JFTC added case examples. One describes a large company asking mid-sized and small suppliers for ★4-level measures, holding briefings, explaining its approach to cost sharing, negotiating prices, and recording the agreement in writing. It is presented as acceptable under the Antimonopoly Act and the Fair Transactions Act (Japan's law on fair dealings with small contractors, formerly the Subcontract Act).
The guidance expects company-wide security costs to be treated as indirect costs, such as labor and general overhead. The METI policy also says buyers should respond positively to price negotiations linked to earning a star.
These documents are written for transactions under Japanese law, and whether they apply to a contract with an overseas entity depends on the contract and the parties. Keep records of what you spend on SCS-related measures, and check with your legal or commercial team before using them in price talks.
What You Can Do Now
Applications are not planned to open until March 2027, but the requirements list is already public. You do not need to wait for the guides or the evaluator list to start on the steps below.
Start From SECURITY ACTION and IPA's SME Guidelines
For companies that have done nothing yet, the SECURITY ACTION declaration is the entry point, and IPA positions it as preparation for ★3 and ★4. The program is aimed at small and mid-sized companies, and whether overseas entities can declare is not stated, so confirm with IPA.
IPA's Information Security Guidelines for SMEs (version 4.0, Japanese) also help. This edition reflects SCS, and its sample security rules in the appendix were revised to match the ★3 and ★4 requirements. If your Japanese parent already uses them, ask for the templates rather than writing policies from scratch.
Self-Check Against the Requirements List
Next, use IPA's published "★3/★4 Requirements and Evaluation Criteria" spreadsheet to sort items into "met" and "not met." Pull out only the 26 items marked for ★3, and you have your first checklist.
Here is a fictional example. A machining company with about 80 employees has its general affairs manager also handling IT. Its designers connect from home to a drawing server through a VPN appliance, and three customers each send their own security checklist every year.
Checking against the ★3 list, this company finds some items already done, such as antivirus software. It is likely to get stuck on questions like these:
- Are there leftover IDs for people who left or changed jobs? Can you tell who used a shared ID?
- Is there a process to apply severe-vulnerability fixes to the VPN appliance and routers within 14 days of release?
- Backups exist, but is there a written restore procedure, and has a restore actually worked?
- Are internal and external contacts and reporting lines set for when an incident occurs?
- Are the roles of the security executive and department defined in writing?
These items mostly involve deciding and documenting, not large investments. That also means it stalls when left to one person with other duties. ★3 requires management to sign a self-declaration of conformity, so bring senior management in early.
Inventory Devices and IDs First
An inventory is the basis for every check. List the maker, OS, and number of PCs, servers, and network devices, the cloud services you use, and who holds which IDs and admin rights. IPA's SME guidelines include a sample asset register.
Pay special attention to devices at the internet boundary. ★4 technical testing checks whether VPN appliances and routers still carry severe vulnerabilities. Record, for each device, whether it has a maintenance contract, when support ends, and who applies updates and when.
Talk to Your Key Customers Early
Whether you need ★3 or ★4 is your customer's call. Ask your main customers' purchasing teams early how they plan to use the scheme and what they will ask for by when, so you can set priorities.
If several customers send separate checklists, there may be room to propose the SCS requirements as a common basis for your answers. As covered above, measures that cost money can be part of price discussions, so record what you spend.
Use Support Programs, and Watch for Misleading Sales Pitches
IPA is running a pilot of a new type of Cybersecurity Otasuke-tai ("helper team") service for SMEs. Fifteen providers chosen by public call offer a package: gap diagnosis, tool rollout, help with rules and training, and application support.
The pilot is scheduled from October 2026 to September 2027, and SMEs can join free of charge. Areas and industries covered vary by provider, and eligibility for overseas sites is not stated, so check IPA's page.
Finally, be wary of vendors using the scheme's name to sell. As the April 2026 warning made clear, you do not need any specific product to earn a star. When in doubt, check the latest information on the official IPA and METI pages.
Questions to Ask Your Japanese Customer
Use these questions when a customer first mentions ★3 or ★4. They turn a vague request into something you can plan and budget for.
- Do you need us to register a star with IPA, or to meet the ★3/★4 criteria (sōtō) and report on them?
- Which level do you need: ★3 or ★4? Is it for all our sites or only those that handle your drawings or connect to your systems?
- By when? Will you accept a self-check against the ★3 list as an interim step before registration?
- Which legal entity should hold the star: our local company, or our Japanese parent's group scope?
- Will this replace the security checklist you currently send us, or come on top of it?
- Will you accept existing certifications (ISO/IEC 27001, TISAX, JAMA/JAPIA Lv1/Lv2 results) as partial evidence?
- How do you plan to discuss costs and pricing for the required measures?
- Will you send the English version of the requirements when IPA publishes it?
Sample Inquiry Email
You can adapt the email below. Replace the bracketed parts, and keep it short; Japanese purchasing teams often forward such emails internally.
Subject: Your request on SCS ★3/★4 security measures – [Company name]
Dear [Name],
Thank you for your message about the Supply Chain Security Assessment Program (SCS). We want to plan our response correctly, so could you confirm the following?
1. Do you require us to register a ★3 or ★4 rating with IPA, or to meet the ★3/★4 criteria and report our status to you?
2. Which level applies to us, and does it cover all of our sites or only specific ones?
3. What is your target date, and would a self-check against the ★3 requirements be acceptable as a first step?
4. Should the rating be held by [local company name], or under our parent company's group scope?
5. Will this replace your current supplier security checklist?We would also like to discuss how the cost of any additional measures will be reflected in pricing.
Best regards,
[Name]
[Title, Company]
Quick Readiness Checklist
Before the first call with your customer, check where you stand on these basics.
- Downloaded the latest ★3/★4 requirements list from IPA and flagged the 26 ★3 items
- Asset inventory of PCs, servers, network devices, and cloud services
- List of user IDs and admin rights, with leavers removed
- Patch process that can meet the 14-day rule for internet-facing devices
- Written backup and restore procedure, with a tested restore
- Incident contacts and reporting lines, including your Japanese customer and parent company
- Named executive and department responsible for security, in writing
- Map of connections between office IT and factory OT networks
- Records of security spending linked to customer requests
Limits of This Guide
- It reflects information published as of the end of September 2026. Detailed procedures will come in guides IPA plans to publish from October 2026, and minor revisions to the requirements were agreed in September 2026.
- The official materials do not yet say whether overseas subsidiaries or non-Japanese companies can apply, or whether experts and evaluators outside Japan can take part. Confirm with IPA or your customer.
- Category names, requirement summaries, and the framework comparison are our translations and summaries. Use IPA's official text (and its English version, once published) for any formal self-assessment.
- Comments on Japanese competition law describe the government guidance only. They are not legal advice and may not apply to contracts outside Japan.
- Your customer decides which level it needs and how to use it in contracts. Requirements can differ by customer and industry.
FAQ
Is the SCS Rating Mandatory for Suppliers to Japanese Companies?
No. METI describes SCS as a voluntary scheme that imposes no regulation. A star becomes necessary only if your contract with a customer requires it, so ask your main customers which level they expect and by when.
Can an Overseas Subsidiary or Non-Japanese Supplier Get ★3 or ★4?
The official materials published as of September 2026 do not say. Applications are made by legal entity as a rule, with business-unit or group scopes possible after review. Ask IPA or your customer, and watch for the English documents IPA plans to publish before launch.
Does ISO/IEC 27001 Certification Count as ★3 or ★4?
No. ISMS certification is described as complementary to ★3 and ★4, not a substitute. ISMS certifies your own risk-based management system, while ★3 and ★4 check a fixed baseline of controls, so you still need to meet each SCS criterion.
Who Can Review a ★3 Self-Assessment?
A registered security expert. They must hold a credential such as Japan's Registered Information Security Specialist, CISSP, CISM, CISA, Certified Information Security Auditor, or ISO/IEC 27001 lead auditor, and complete the scheme's training. Your IT staff qualify only if they meet these conditions.
How Do JAMA/JAPIA Guideline Levels Relate to ★3 and ★4?
METI's policy says ★3 corresponds to Lv1 and ★4 to Lv2 of the JAMA/JAPIA Cybersecurity Guidelines. How results will be linked is still under discussion, so treat existing Lv1/Lv2 work as a head start, not as a star.
Sources
- Scheme policy, history, and start-date wording: METI news release on the SCS scheme policy, March 27, 2026 (Japanese)
- Levels, scope, evaluation, validity, links to other schemes, and comparison with CMMC, TISAX, and Cyber Essentials: Policy for Building the Supply Chain Security Assessment Scheme, March 2026 (Japanese)
- Requirements and evaluation criteria list: IPA, "★3/★4 Requirements and Evaluation Criteria" (Japanese)
- Scheme overview, notices, and FAQ (including plans for English materials): IPA SCS official site and FAQ (Japanese)
- Application start date, schedule, and official English name (SCS-AP): IPA 3rd operating council meeting materials, September 11, 2026 and summary minutes (Japanese)
- Registration fees: IPA fee notice, September 18, 2026 (Japanese)
- Voluntary nature and FAQ: METI SCS page (Japanese)
- Warning about misleading sales pitches: METI and National Cybersecurity Office, April 27, 2026 (Japanese)
- Requests to suppliers and competition law: METI and JFTC, building partnerships with suppliers for supply chain cybersecurity (Japanese)
- IPA's English name change: IPA press release, June 5, 2026 (Japanese)
- National Cybersecurity Office: Prime Minister's Office, opening ceremony of the National Cybersecurity Office, July 2025
- SECURITY ACTION: IPA, SECURITY ACTION self-declaration (Japanese)
- SME guidelines: IPA, Information Security Guidelines for SMEs (Japanese)
- Otasuke-tai (new type) pilot: IPA, Cybersecurity Otasuke-tai service pilot (Japanese)
- JAMA/JAPIA guidelines: JAMA, Automotive Industry Cybersecurity Guidelines and V2.3 handbook (English)
- Factory system guidelines: METI, Cyber/Physical Security Guidelines for Factory Systems
- NIST CSF 2.0: NIST Cybersecurity Framework
- ISMS conformity assessment: ISMS Accreditation Center (ISMS-AC), ISMS conformity assessment scheme (Japanese)
Original article in JapaneseThis guide is adapted from a MONOSCOPE article written for readers in Japan: セキュリティ対策評価制度（SCS）とは｜★3・★4で部品メーカーが備えること
About the editor
MONOSCOPE EditorFOUNDER & EDITORSpent about ten years at a plant equipment maker and a plant engineering company, proposing, designing, and commissioning equipment, then moved into web marketing. Now a web consultant for B2B manufacturers, helping them explain their products and technology. Licensed in Japan as an Energy Manager and a Third-Class Chief Electrical Engineer.
Has run an engineering blog since 2017 (500+ articles) and a Japanese YouTube channel with about 20,000 subscribers. Each English guide is written from the Japanese shop-floor point of view and checked against the cited standards.
