ISMAP
Information system Security Management and Assessment Program (Japan) — ISMAP Steering Committee (Government of Japan)
Also known as: ISMAP, ISMAP-LIU, Japan ISMAP
At a glance
- Status
- In force
- Next deadline
- None announced
- Who must comply
- Cloud service providers that want government ministries and agencies to procure their services; procuring bodies buy, in principle, from the ISMAP cloud service lists. source
- How it is assessed
- A cloud provider is audited by an ISMAP-registered audit institution against the Control Criteria and is then registered by the Steering Committee; registration must be renewed. source
- Written by
- The ISMAP Steering Committee sets the rules and registers services; the programme is run by the National Cybersecurity Office, the Digital Agency, the Ministry of Internal Affairs and Communications and the Ministry of Economy, Trade and Industry, with IPA support. source
- Enforced by
- The Steering Committee can suspend or revoke a service's registration after monitoring, re-examination or a security incident. source
- Last change
Japan's FedRAMP: a cloud service must be on the ISMAP register before a government body may procure it, and registration is granted against the ISMAP control baseline derived from ISO/IEC 27001, 27017 and NIST SP 800-53. ISMAP-LIU extends the same machinery to lower-risk services.
Recent changes
-
Info
ISMAP Cloud Service List updated with service consolidation for IIJ-related services
A consolidation notification was submitted by IIJ (Internet Initiative Japan) regarding multiple cloud services, resulting in updates to the ISMAP Cloud Service List registration. Three registrations—C24-0076-2 …
-
Info
Consolidates and renames Zscaler services on ISMAP Cloud Service List
Due to consolidation of Zscaler service registration units, "Zscaler Private Access for Japanese Government" (C23-0063-2) has been removed from the ISMAP Cloud Service List. Simultaneously, "Zscaler …
Key dates
No upcoming dates- ISMAP updates its schedule for the revised Control Criteria, planning the revised rules for May 2027
- ISMAP Basic Regulations revised after the reorganisation of the national cybersecurity centre
- Latest revision of the ISMAP Control Criteria takes effect
- ISMAP-LIU provisions added to the ISMAP rules
Show 1 earlier date
Version history
-
ISMAP Control Criteria (revised 1 August 2024) RevisionCurrent
Attached Table 8 was revised. source
-
ISMAP Control Criteria (revised 1 July 2024) Revision
Chapter 5 control criteria and the detailed controls in Attached Tables 3 to 5 were revised to follow the July 2023 revision of the Common Standards for government cybersecurity, with four new and five revised detailed controls. source
-
ISMAP Control Criteria (revised 1 November 2022) Revision
Provisions for ISMAP-LIU, the track for low-risk SaaS, were added. source
-
ISMAP Control Criteria (revised 1 April 2022) Revision
Control objectives were added to the Chapter 5 control criteria, and detailed controls were revised after the July 2021 revision of the Common Standards for government agencies. source
-
ISMAP Control Criteria (3 June 2020) Major version
The ISMAP rules, including the Control Criteria, took effect on 3 June 2020. source
Show 1 older version
-
—
Draft revised ISMAP Control Criteria (December 2025) Draft
A draft revision reflecting JIS Q 27001:2023, JIS Q 27002:2024 and ISO/IEC 27014:2020 and reducing the number of controls; its revision and effective dates are still under consideration. source
More
- The schedule updated on 17 September 2026 plans the guidelines and the revised rules, including the Control Criteria, for May 2027, with the effective date set later to allow preparation and a period of parallel operation.
- A separate, lighter framework for SaaS providers is also being created.
Who it applies to
ISMAP applies to cloud services offered to Japanese government bodies, which in principle procure from the ISMAP lists; lower-risk SaaS uses the ISMAP-LIU track.
How compliance is assessed
A cloud provider is audited by an ISMAP-registered audit institution against the Control Criteria and is then registered by the Steering Committee; registration must be renewed.
- Audit
- Providers have audit institutions on the ISMAP Audit Institution List audit their implementation of security measures against the Control Criteria. source
- Registration validity
- Registration is valid until one year and four months after the day following the end of the audited period, and the provider must apply for renewal before it expires. source
- Incident reporting
- Providers must immediately report information security incidents that could significantly affect users of their registered service. source
Enforcement and penalties
The Steering Committee can suspend or revoke a service's registration after monitoring, re-examination or a security incident.
- Suspension or revocation
- The Steering Committee may temporarily suspend or revoke a registration based on monitoring, re-examination or re-assessment, after an information security incident, or when a provider fails without justification to comply with its requests. source
Documents
- Standard 制度規程等 (ISMAP rules and regulations)
- Standard ISMAP管理基準 (ISMAP Control Criteria)
- Standard ISMAP管理基準改定案 (draft revised Control Criteria)
- Guidance ISMAP Overview (English)
Frequently asked questions
When will the revised ISMAP Control Criteria take effect?
Not yet fixed. The schedule updated on 17 September 2026 plans the revised rules for May 2027, with the effective date set later to allow a preparation period. source
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to ISMAP (RSS)