ISMAP (Japan)Supported in OneClickComply

Prepare for ISMAP registration with evidence you collect once

ISMAP (Information system Security Management and Assessment Program) is the Government of Japan's scheme for assessing and registering cloud services that government bodies may procure.

See the ISMAP requirements

Issued by: ISMAP Steering Committee (National Cybersecurity Office, Digital Agency, MIC and METI)
In operation since: June 2020
Current criteria: ISMAP Control Criteria, last fully restructured April 2022 with targeted amendments in July 2024; a major revision aligned to ISO/IEC 27002:2022 is planned from 2027
Based on: JIS Q 27001, 27002, 27014 and 27017, the Government Common Standards and NIST SP 800-53

ISMAP mapped

Automated evidence

Continuous monitoring

Who needs ISMAP

Is ISMAP right for your organisation?

Providers declare which controls they implement, are audited by an ISMAP-registered auditor against the ISMAP Control Criteria, and, once approved, are published on the ISMAP Cloud Service List. A lighter route, ISMAP-LIU, exists for low-impact SaaS.

Any cloud service provider, Japanese or international, that wants to supply IaaS, PaaS or SaaS to Japanese government ministries and agencies needs ISMAP registration, because government bodies are expected in principle to procure from the ISMAP list. Private sector buyers in Japan also increasingly use the list as a trust signal when choosing cloud vendors.

It is usually required by customers, partners or schemes rather than by law.

How we help

How OneClickComply helps with ISMAP

OneClickComply supports ISMAP today: the governance, management and control criteria are linked to the same controls you use for ISO 27001, so existing evidence counts towards ISMAP. Automated evidence collection, continuous monitoring and AutoComplete policies help you keep the year-round control operation an ISMAP audit period requires, with our in-house audit team on hand to answer questions.

Requirements covered

Three tiers of criteria: governance criteria (Chapter 3, based on JIS Q 27014), management criteria (Chapter 4, based on JIS Q 27001) and control criteria (Chapters 5 to 18, the 114 JIS Q 27002 control objectives), with over 1,000 detailed controls including cloud-specific items marked .P and baseline items marked .B.

Issued by: ISMAP Steering Committee (National Cybersecurity Office, Digital Agency, MIC and METI)
In operation since: June 2020
Current criteria: ISMAP Control Criteria, last fully restructured April 2022 with targeted amendments in July 2024; a major revision aligned to ISO/IEC 27002:2022 is planned from 2027
Based on: JIS Q 27001, 27002, 27014 and 27017, the Government Common Standards and NIST SP 800-53
Applies to: Cloud services procured by Japanese government bodies
Assessment route: Self-declaration audited by an ISMAP-registered auditor, then review and listing on the ISMAP Cloud Service List
Audit period: Up to one year, with consecutive periods required to stay listed
Type: Certification (contractual)
Region: Japan, Asia-Pacific
In OneClickComply: Supported today

Already working towards another framework?

ISO 2700116% shared
SOC 274% shared
NIST CSF56% shared
GDPR6% shared

Share of ISMAP controls covered by each framework in OneClickComply's mappings. Evidence collected once counts towards both.

Why automate

Manual ISMAP compliance vs OneClickComply

Doing it manually

Deciding control by control which of over 1,000 detailed controls to adopt and justifying each exclusion
Rebuilding evidence already gathered for ISO 27001 or SOC 2 in a different structure
Proving controls operated across a full audit period with screenshots and spreadsheets
Keeping up with criteria amendments and the planned move to the 2022 control set
Chasing evidence for underlying cloud services and suppliers in scope of the declaration

With OneClickComply

Controls mapped once in a single library, so adoption decisions sit alongside your other frameworks
Evidence collected once counts towards ISMAP, ISO 27001 and SOC 2 where controls overlap
Automated, timestamped evidence and drift alerts covering the whole audit period
Control mapping kept current as criteria change, so gaps are visible early
Vendor risk records and supplier evidence held in one place for the auditor

Capabilities

Everything you need for ISMAP

ISMAP criteria mapped to your existing ISO 27001 and ISO 27017 controls
Automated evidence collection across cloud, identity and device tools
Continuous monitoring to show controls operated throughout the audit period
AutoComplete policies covering ISMAP governance and management criteria
OneClickFix for supported cloud misconfigurations, logged as evidence
Vendor risk management for subcontracted and underlying cloud services

How it works

Three steps to ISMAP compliance

Connect and scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against ISMAP and shows which controls pass and which fail.
Fix and generate
OneClickFix fixes supported misconfigurations automatically, and AutoComplete drafts ISMAP policies from your real environment.
Monitor and evidence
Continuous monitoring flags drift as it happens, and our in-house audit team is on hand when you need expert guidance.

See how far your current setup is from ISMAP.

Requirements

ISMAP (Japan) requirements

The governance and management criteria process headings (Chapters 3 and 4) and all 114 control objectives of the control criteria (Chapters 5 to 18); each contains detailed controls, numbered X.X.X.X, that are not listed individually.

Reference	Requirement
3.1.2	Governance process: evaluate
3.1.3	Governance process: direct
3.1.4	Governance process: monitor
3.1.5	Governance process: communicate
3.1.6	Governance process: assure
4.4.1	Organisational roles, responsibilities and authorities
4.4.2	Understanding the organisation and its context
4.4.3	Understanding the needs and expectations of interested parties
4.4.4	Determining the scope
4.4.5	Establishing the information security policy
4.4.6	Actions to address risks and opportunities
4.4.7	Information security risk assessment
4.4.8	Information security risk treatment
4.5.1	Resource management
4.5.2	Competence and awareness
4.5.3	Communication within the management system
4.5.4	Operational planning and control
4.5.5	Performing information security risk assessments
4.6.1	Continual improvement of effectiveness
4.6.2	Performance evaluation
4.6.3	Management review
4.7.1	Corrective action
4.8.1	Documentation guidelines
4.8.2	Creating, updating and controlling documents
4.9.1	Planning risk communication
4.9.2	Conducting risk communication
5.1.1	Policies for information security
5.1.2	Review of the policies for information security
6.1.1	Information security roles and responsibilities
6.1.2	Segregation of duties
6.1.3	Contact with authorities
6.1.4	Contact with special interest groups
6.1.5	Information security in project management
6.2.1	Mobile device policy
6.2.2	Teleworking
7.1.1	Screening
7.1.2	Terms and conditions of employment
7.2.1	Management responsibilities
7.2.2	Information security awareness, education and training
7.2.3	Disciplinary process
7.3.1	Termination or change of employment responsibilities
8.1.1	Inventory of assets
8.1.2	Ownership of assets
8.1.3	Acceptable use of assets
8.1.4	Return of assets
8.2.1	Classification of information
8.2.2	Labelling of information
8.2.3	Handling of assets
8.3.1	Management of removable media
8.3.2	Disposal of media
8.3.3	Physical media transfer
9.1.1	Access control policy
9.1.2	Access to networks and network services
9.2.1	User registration and de-registration
9.2.2	User access provisioning
9.2.3	Management of privileged access rights
9.2.4	Management of secret authentication information of users
9.2.5	Review of user access rights
9.2.6	Removal or adjustment of access rights
9.3.1	Use of secret authentication information
9.4.1	Information access restriction
9.4.2	Secure log-on procedures
9.4.3	Password management system
9.4.4	Use of privileged utility programs
9.4.5	Access control to program source code
10.1.1	Policy on the use of cryptographic controls
10.1.2	Key management
11.1.1	Physical security perimeter
11.1.2	Physical entry controls
11.1.3	Securing offices, rooms and facilities
11.1.4	Protecting against external and environmental threats
11.1.5	Working in secure areas
11.1.6	Delivery and loading areas
11.2.1	Equipment siting and protection
11.2.2	Supporting utilities
11.2.3	Cabling security
11.2.4	Equipment maintenance
11.2.5	Removal of assets
11.2.6	Security of equipment and assets off-premises
11.2.7	Secure disposal or re-use of equipment
11.2.8	Unattended user equipment
11.2.9	Clear desk and clear screen policy
12.1.1	Documented operating procedures
12.1.2	Change management
12.1.3	Capacity management
12.1.4	Separation of development, testing and operational environments
12.2.1	Controls against malware
12.3.1	Information backup
12.4.1	Event logging
12.4.2	Protection of log information
12.4.3	Administrator and operator logs
12.4.4	Clock synchronisation
12.5.1	Installation of software on operational systems
12.6.1	Management of technical vulnerabilities
12.6.2	Restrictions on software installation
12.7.1	Information systems audit controls
13.1.1	Network controls
13.1.2	Security of network services
13.1.3	Segregation in networks
13.2.1	Information transfer policies and procedures
13.2.2	Agreements on information transfer
13.2.3	Electronic messaging
13.2.4	Confidentiality or non-disclosure agreements
14.1.1	Information security requirements analysis and specification
14.1.2	Securing application services on public networks
14.1.3	Protecting application services transactions
14.2.1	Secure development policy
14.2.2	System change control procedures
14.2.3	Technical review of applications after operating platform changes
14.2.4	Restrictions on changes to software packages
14.2.5	Secure system engineering principles
14.2.6	Secure development environment
14.2.7	Outsourced development
14.2.8	System security testing
14.2.9	System acceptance testing
14.3.1	Protection of test data
15.1.1	Information security policy for supplier relationships
15.1.2	Addressing security within supplier agreements
15.1.3	Information and communication technology supply chain
15.2.1	Monitoring and review of supplier services
15.2.2	Managing changes to supplier services
16.1.1	Incident management responsibilities and procedures
16.1.2	Reporting information security events
16.1.3	Reporting information security weaknesses
16.1.4	Assessment of and decision on information security events
16.1.5	Response to information security incidents
16.1.6	Learning from information security incidents
16.1.7	Collection of evidence
17.1.1	Planning information security continuity
17.1.2	Implementing information security continuity
17.1.3	Verify, review and evaluate information security continuity
17.2.1	Availability of information processing facilities
18.1.1	Identification of applicable legislation and contractual requirements
18.1.2	Intellectual property rights
18.1.3	Protection of records
18.1.4	Privacy and protection of personally identifiable information
18.1.5	Regulation of cryptographic controls
18.2.1	Independent review of information security
18.2.2	Compliance with security policies and standards
18.2.3	Technical compliance review

Always check the official text of ISMAP for the exact wording.

FAQs

ISMAP questions, answered

Can't find what you need? Our in-house auditors can talk you through ISMAP on a 30-minute call.

What is ISMAP?

ISMAP is the Information system Security Management and Assessment Program, the Government of Japan's security assessment scheme for cloud services. Cloud providers declare the controls they implement, are audited by an ISMAP-registered auditor against the ISMAP Control Criteria, and approved services are published on the ISMAP Cloud Service List. Japanese government bodies use this list when procuring cloud services. The scheme has operated since June 2020 and is run by the ISMAP Steering Committee.

Who needs ISMAP registration?

Cloud service providers that want to sell IaaS, PaaS or SaaS to Japanese government ministries and agencies need ISMAP registration, because government bodies are expected in principle to procure cloud services from the ISMAP list. It is not a legal obligation on private companies, but without it a provider is at a serious disadvantage in Japanese public sector tenders. Many Japanese private sector buyers also treat registration as evidence of strong cloud security.

What is ISMAP-LIU?

ISMAP-LIU (ISMAP for Low-Impact Use) is a lighter registration route introduced in 2022 for SaaS used for low-risk government work involving less sensitive information. It uses the same ISMAP Control Criteria but with a reduced set of controls for audit, and a service must first be confirmed as eligible. Services that pass are listed on a separate ISMAP-LIU Cloud Service List.

How is ISMAP different from ISO 27001?

ISMAP builds on ISO 27001 but goes further. Its criteria combine JIS Q 27001, 27002, 27014 and 27017 with Japan's Government Common Standards and NIST SP 800-53, and include over 1,000 detailed controls. Instead of a certificate, ISMAP uses a declaration audited by an ISMAP-registered auditor and a government review before listing. An existing ISO 27001 programme gives you a strong head start, but it does not replace ISMAP.

How long does ISMAP registration take?

ISMAP registration usually takes many months, because controls must operate over an audit period before the audit and government review can be completed. The audit period can be up to one year, and if it is shorter it needs at least three months of operation. To stay listed, providers must be audited again for each following period with no gaps, so ISMAP is an ongoing commitment rather than a one-off project.

What happens if a cloud service is not ISMAP registered?

There is no fine for not being registered, because ISMAP is a procurement scheme rather than a law. The consequence is commercial: Japanese government bodies are expected in principle to choose cloud services from the ISMAP list, so an unregistered service will struggle to win government business. A registered service can also be removed from the list if it fails to maintain its audits or controls.

Are the ISMAP Control Criteria changing?

Yes. A revision of the ISMAP Control Criteria was published in draft in December 2025 to align with ISO/IEC 27001:2022 and 27002:2022. It regroups the control criteria into organisational, people, physical, technological and cloud-specific controls and cuts the number of detailed controls. Guidance and regulations were due in March 2027, with the new criteria applying after that. Providers should check the ISMAP portal for confirmed dates.

Does OneClickComply support ISMAP?

Yes. OneClickComply supports ISMAP today. The ISMAP criteria are linked to the same controls you use for ISO 27001 and other frameworks, so evidence collected once counts towards each. OneClickComply does not issue ISMAP registration: that comes from an ISMAP-registered auditor's audit and the government review.

Related frameworks

All frameworks

Products

Start working towards ISMAP

Automate controls, gather evidence continuously and stay audit-ready, all on one platform.

Prepare for ISMAP registration with evidence you collect once

Is ISMAP right for your organisation?

How OneClickComply helps with ISMAP

Manual ISMAP compliance vs OneClickComply

Everything you need for ISMAP

Three steps to ISMAP compliance

Connect and scan

Fix and generate

Monitor and evidence