ISG: Japan Information Security Guidelines for Cloud

Japan's Information Security Guidelines for cloud service providers, jointly developed by METI and MIC, establish security expectations for cloud services operating in the Japanese market. These guidelines, supplemented by the ISMAP (Information system Security Management and Assessment Program) for government cloud procurement, form the framework for cloud security assurance in Japan — the world's third-largest cloud market.

What the Guidelines Cover

The guidelines address cloud-specific security considerations including shared responsibility models, multi-tenancy risks, data location transparency, and service continuity. They align with international standards, particularly ISO 27017 (cloud security extension to ISO 27001) and ISO 27018 (protection of PII in public clouds), while incorporating Japanese regulatory requirements.

ISMAP, launched in 2020, creates a marketplace of pre-assessed cloud services for government use. ISMAP requires cloud providers to meet security controls based on international standards (ISO 27001, 27017, 27018) plus additional Japanese government requirements, with assessment by registered auditors.

Who Should Follow These Guidelines

Cloud service providers targeting Japanese customers — particularly government agencies and regulated industries — should align with these guidelines. ISMAP certification is effectively required for cloud services used by Japanese government agencies. Japanese enterprises, particularly in manufacturing and financial services, increasingly reference these guidelines when evaluating cloud providers.

Implementation Approach

Assess your cloud service against the guidelines, focusing on areas where Japanese requirements diverge from international standards — particularly around data location disclosure, Japanese-language incident communication, and local regulatory compliance. For government market access, pursue ISMAP certification by engaging a registered auditor and submitting assessment results. Maintain ISO 27001, 27017, and 27018 certifications as prerequisites.

Cost Considerations

Alignment with the guidelines can be achieved for $20,000 to $50,000 on top of existing ISO certification costs. ISMAP certification adds $50,000 to $120,000 for the formal assessment and annual renewal. The investment is essential for accessing Japan's government cloud market and provides credibility with enterprise customers in Japan's $40+ billion cloud market.