Japan's SCS Supply-Chain Security Rating for Engineers: ★3/★4 Requirements, the 14-Day Patch Rule and the Technical Verification

On 28 October 2026, IPA (the Information-technology Promotion Agency, Japan) published the assessment guides and the explanatory handbook for its "Security Rating Scheme for Strengthening Supply Chains" (the SCS rating scheme). The scheme itself was announced in April, but with these documents it is now clear what has to be done, to what level, and how it has to be proven, so practical preparation can start ahead of the first applications in March 2027.

This article is for the IT, infrastructure and web staff who will do the work when a customer says "please get ★3". It pulls out the requirements that involve technical work, and the thresholds that are fixed by numbers, from the primary documents (SCS-400 Ver.1.1, SCS-430 and SCS-620). For the big picture, read the general guide first; for the business impact and the decisions management has to make, read the guide for executives.

Also published on the author's blog nkzw.jp.

The scheme in one minute

• Official name: Security Rating Scheme for Strengthening Supply Chains, abbreviated as the SCS rating scheme. IPA runs it as the scheme owner, under the supervision of the Ministry of Economy, Trade and Industry (METI) and the National Cybersecurity Office of the Cabinet Secretariat
• It is voluntary and not a legal obligation. The design assumes that an outsourcer tells its supplier which level (★) it needs, and that the level is used in the business contract
• There are three levels: ★3, ★4 and ★5. There is no ★1 or ★2; IPA's existing SECURITY ACTION programme (self-declared one-star and two-star commitments) is the foundation. ★5 is still under study
• ★3 proves 26 requirements (81 evaluation criteria) by a self-assessment confirmed by an expert; ★4 proves 43 requirements (153 evaluation criteria) by a third-party assessment plus technical verification. ★3 is valid for 1 year, ★4 for 3 years
• The registration fee is ¥10,000 per year for ★3 (until the end of March 2028; ¥20,000 after that) and ¥60,000 for 3 years for ★4. Fees paid to assessment bodies and experts are separate
• Applications are scheduled to open in March 2027. Before that, the registration application guide (end of November), the list of assessment bodies (late December) and the list of experts (January 2027 onwards) will be published in that order
• The requirement cascades down to tier-3 suppliers and below. Category 2, "supplier management", is part of the requirements from ★3, and ★4 goes as far as knowing your suppliers' security status (2-1-3). Once a large company writes ★ into its procurement standards, companies that do not meet it are not chosen as suppliers. "Voluntary" describes the legal position; in the supply chain it becomes effectively mandatory

The requirements are organised into 7 categories (governance, supplier management, risk identification, protection, detection, incident response, recovery) and 16 subcategories, and every evaluation criterion is mapped to a function of NIST CSF 2.0 (GV/ID/PR/DE/RS/RC).

★3 versus ★4: depth, and how you prove it

You can apply for ★4 directly without holding ★3, because each higher level contains all the requirements of the lower ones.

From a technical point of view, most ★3 items are about showing in documents that you have set rules, communicated them and review them once a year. ★4 is the first level where you prove on real equipment, through an external vulnerability scan, that there is nothing at CVSS 7.0 or above.

Thresholds fixed by numbers (miss these and you fail)

These are the SCS-400 evaluation criteria whose deadlines or thresholds are written as numbers. The numbers in brackets are the evaluation criterion IDs.

3.1 Patches within 14 days of release (4-4-4-2, ★3)

At ★3, an update must be applied within 14 days of its release if any of the following is true:

• it fixes a vulnerability that the vendor describes as "Critical" or "High Risk"
• it fixes a vulnerability with a CVSS base score of 7.0 or higher
• the vendor gives no information on the severity of the vulnerability

The scope is spelled out: the OS, browser and Office software of company-issued PCs, the OS and middleware of servers, the OS and apps of company-issued smart devices, and the OS and firmware of network devices at the internet boundary. If testing takes too long to meet the deadline, risk-reduction measures are required until the update is applied.

PHP, nginx and Apache on a web server count as "server middleware". For the critical 2026 PHP vulnerabilities (CVSS 9.8), the author's own observation found that 59.5% of Japanese sites that disclose their PHP version were showing an unpatched version (Security Exposure Statistics 2026). Applied literally, the 14-day rule would put most of them out of compliance.

3.2 End-of-support products: remove them or cut them off from the internet (4-4-4-1, ★3)

Devices, operating systems and software must be "licensed and supported". Anything out of support must, in principle, be removed, or have all traffic to and from the internet blocked so that it leaves the scope. If it has to stay in use, risk-reduction measures are required, and automatic updates should be enabled where possible.

At ★4, "stopping the use of, and replacing, operating systems and software whose support has ended" becomes a requirement of its own (4-4-2).

3.3 No CVSS 7.0+ on boundary devices (4-4-4-3, ★4)

At ★4, the OS and firmware of network devices at the internet boundary must not have any vulnerability with a CVSS base score of 7.0 or higher, and this is tested from outside in the technical verification described below.

3.4 Multi-factor authentication (4-1-3, required from ★3)

• Access to cloud services that handle important confidential information must always use multi-factor authentication, for users and administrators alike (4-1-3-2)
• Two or more kinds of factor from knowledge (ID and password), possession (one-time password or certificate), biometrics, and other information (such as the IP address). One-time passwords sent by email or SMS and push approval on a smartphone count as possession factors (4-1-3-3)
• Passwords used as the knowledge factor in MFA must be at least 8 characters (4-1-3-4)
• At ★4, MFA is also required for connections to the internal network over the internet, for administrator access over the internet, and for user access to systems that handle important confidential information (4-1-3-5)

3.5 Passwords (4-1-5, ★3)

• Internal rules must require changing default passwords, ban easily guessed words, and ban reusing passwords across devices and services
• With either MFA or account lockout after 10 failed attempts, passwords must be at least 8 characters. If neither is possible, they must be at least 10 characters, including upper-case letters, lower-case letters and digits (4-1-5-3)

3.6 Firewalls and routers (4-5-1, ★3)

• Change the management password to a strong, unique one, or disable remote access entirely
• Block unauthenticated inbound traffic and document the inbound rules. Remove or disable rules that are no longer needed without delay
• If rules are changed over the internet, use MFA or restrict access to trusted IP addresses (4-5-1-7)
• ★4 adds a software firewall on every PC and server (4-5-1-8), and dedicated network segments for public servers and servers holding important information (4-5-1-9)

3.7 Backup (4-3-4, ★3)

Define what is backed up, how often and for how long; keep an off-site backup of important confidential information; and write a restore procedure for each backup target. ★4 goes further and requires confirming that a restore actually works within the recovery time objective (7-1-1-2).

3.8 Anti-malware and monitoring (4-4-5 and 5-1-1, ★3)

• Install anti-malware software on every networked PC and server, define the scan scope and frequency, and update signatures as the vendor recommends
• At the network boundary or on endpoints, a mechanism that detects and blocks in real time both inbound traffic from the internet and outbound traffic to malicious servers (5-1-1-1). Alerts must be raised promptly and a preliminary report produced
• ★4 adds blocking of malicious sites at a web gateway, malware checks at a mail gateway, monitoring of device and software behaviour, and collection and regular review of logs

3.9 Reviews "at least once a year"

"Review at least once a year" appears again and again: for the organisation, the asset registers, compliance with the rules, the incident response set-up and more. The 1-year validity of ★3 matches this cycle. If you build record-keeping for these reviews into your operations from the start, you will not have to collect the evidence again at every renewal.

What the ★4 technical verification does (SCS-430)

The ★4 technical verification is an external vulnerability scan carried out by the assessment body or by a technical verification provider. The key points of the guide are:

• Devices in scope: VPN appliances, routers, firewalls and similar traffic-control devices within the scope that can be reached directly from outside. It is not a web application assessment
• Method: simulated attack traffic from outside, including port scans, to check for vulnerabilities with a CVSS base score of 7.0 or higher. Any tool may be used; the provider chooses it with reference to the platform scanning tools of SSS (Japan's Information Security Service Standard registration scheme)
• Number of devices: in principle 5 candidate devices. Devices of the same model and firmware are grouped and a representative chosen, with priority to devices that expose more ports. You may ask for 6 or more, or all of them
• Preparation: agree the test window, get approval from management or the information security officer, inform the CSIRT/SOC, receive the scanner's source IP addresses, and check the cloud provider's policy if cloud devices are included
• Remediation: if something is found, fix it within 14 days of receiving the scan results and have it scanned again
• Exemption and substitution: if every device is managed by an ISP or similar and permission to scan cannot be obtained, an evidence review replaces the scan. If a recent scan of equal or wider scope exists and the company that ran it meets the requirements for technical verification providers, you can apply for an exemption

In practice, the first job is to work out whether devices you do not think of as yours (routers at branch offices, rented VPN appliances, virtual appliances in the cloud) fall within the scope. Chapter 3 of the handbook (SCS-620) has worked examples for a company with a few sites and for a group with many subsidiaries, and a list of questions to ask cloud providers.

Unit of certification and scope

In the assessment sheet you choose the unit of certification: the whole legal entity, part of it such as a business division, or a corporate group. The scope is the IT infrastructure to be assessed, and protective measures are needed at its boundary.

The handbook assumes three attack surfaces: "logical access to the IT infrastructure in operation", "physical access to the IT infrastructure in operation" and "physical access to IT components at disposal". The software supply chain at development and procurement time is not necessarily in scope. It is worth noting that the scheme does not ask you to manage SBOMs or build pipelines.

How to be ready for March 2027

Applications are scheduled to open in March 2027. The assessment sheet (an Excel file with three sheets: common, ★3 and ★4) is already published, so you can start filling it in now.

1. Decide the unit of certification and the scope (1 to 2 weeks). Until you decide whether branch offices, subsidiaries, cloud services and remote-work devices are included, the rest of the work cannot be sized
2. Self-assess the current state against the 26 requirements. Of the 81 evaluation criteria, those of the "set a rule", "communicate it" and "review it once a year" type only need documents. The items that need technical work are those in section 3
3. Technical implementation (2 to 3 months is the figure heard in the industry). Full MFA roll-out, replacement of end-of-support products, an operational 14-day patch rule, a review of boundary-device settings, off-site backup and restore procedures
4. Collect the evidence (1 to 2 months). Asset registers, rule documents, review records, records of communication, screenshots of alert settings and so on
5. Confirmation by an SCS security expert (★3) or an engagement with an assessment body (★4). The list of experts is due from January 2027, the list of assessment bodies in late December 2026
6. Management's self-declaration of conformity and the registration application. The details of the procedure will be fixed in the "registration application guide", due at the end of November 2026

If you aim for ★4, book a technical verification provider early. Requests are expected to pile up at the assessment bodies as soon as applications open.

What the scheme does not ask for

A few points that are easy to misread, taken from the FAQ and the handbook:

• No specific product is required. Product categories such as EDR do not appear in the requirements
• There is no legal obligation to obtain a rating. IPA says that "obtaining a rating is voluntary" and that "not meeting every requirement does not mean business is stopped immediately". However, once a customer writes ★ into its procurement standards, companies that do not meet it cannot be contracted. Whether to make it a business condition is up to the contracting parties; whether to make it a requirement in public tenders is up to the procuring body
• It does not override other legal frameworks. It does not guarantee compliance with, for example, the safety standards of critical infrastructure sectors. It complements ISMS
• There is no such thing as an "accredited support organisation". In April 2026, METI and the Cabinet Secretariat warned against inappropriate sales pitches that claim business will be restricted without a rating

What web server administrators can do today

The technical verification of the SCS rating scheme covers boundary devices, but the 14-day rule in section 3.1 and the end-of-support requirement in section 3.2 apply directly to the OS, PHP and middleware on your web servers.

Start by checking the versions your servers show to the outside world and whether they are still supported. Enter a URL in Site Scouter's server information check to see, without registration, the versions in the Server and X-Powered-By headers, the TLS version, the certificate and the security headers. How to switch PHP versions on shared hosting is covered in The practical guide to upgrading PHP.

FAQ

Can I apply for ★4 without ★3?

Yes. Because each higher level contains all the requirements of the lower ones, the handbook states that you can apply for ★4 registration even if you do not hold ★3.

Does the technical verification test web applications?

No. The technical verification guide (SCS-430) covers traffic-control devices that can be reached directly from outside, such as VPN appliances, routers and firewalls, and checks them from outside for vulnerabilities with a CVSS base score of 7.0 or higher.

Is the 14-day patch rule required at ★3 too?

Yes. Evaluation criterion 4-4-4-2 belongs to the ★3 requirement "procedures for security patches and updates", and requires updates rated Critical/High or CVSS 7.0 or higher to be applied within 14 days.

How much does it cost?

The registration fee paid to IPA is ¥10,000 per year for ★3 (until 31 March 2028; ¥20,000 after that) and ¥60,000 for 3 years for ★4. Fees paid to SCS security experts, assessment bodies and technical verification providers are not in the scheme's fee table and are set by the market.

Does holding ISMS exempt me from ★4?

There is no exemption rule. The FAQ describes ISMS and the scheme as complementary.

References

Last checked: 2026-10-30. Specifications and policies can change; check the primary sources before acting.

• IPA: Security Rating Scheme for Strengthening Supply Chains (SCS rating scheme)
• IPA: Overview of the level-based assessment (SCS scheme details)
• IPA: Requirements and evaluation criteria (SCS-400 Ver.1.1, SCS-410/420/430, SCS-620)
• IPA: Frequently asked questions
• IPA: Fee notice (2026-09-18, PDF)
• IPA: Press release on the assessment guides (2026-10-28)
• METI: SCS rating scheme special site
• NIST: Cybersecurity Framework 2.0