Japan's SCS Rating Will Sort Suppliers: What Executives Need to Know About a ★ Requirement That Cascades to Tier-3 Suppliers

In March 2027, applications open for the SCS rating scheme (the Security Rating Scheme for Strengthening Supply Chains) run by IPA, the Information-technology Promotion Agency, Japan. On 28 October 2026 the assessment guides and the explanatory handbook were published, and the content of the scheme is now settled.

For executives, one point matters most: the scheme is designed to cascade not only to the tier-1 suppliers that deal directly with large companies, but down to tier-2 and tier-3 suppliers as well. Once a large company writes "★3 or higher" into its procurement standards, companies that do not meet the standard can no longer be chosen as suppliers. And because a tier-1 supplier that wants ★4 must, under the requirements, know the security status of its own suppliers (tier-2), the requirement keeps flowing down the chain.

This article is for executives on both sides: those who will be asked for a ★ as a business condition, and those who will ask for one. Based on the primary documents (IPA's scheme documents), it covers how the scheme works, why it cascades, what happens to companies that do not meet it, the decisions to make, and the cost and time involved. The technical details are in the guide for engineers and an introduction to the scheme is in the general guide.

Also published on the author's blog nkzw.jp.

What has been decided

• IPA runs the scheme under the supervision of the Ministry of Economy, Trade and Industry and the National Cybersecurity Office of the Cabinet Secretariat. Its basis is the "scheme design policy" of March 2026
• There are three levels: ★3, ★4 and ★5. ★3 proves 26 requirements through a self-assessment confirmed by an expert; ★4 proves 43 requirements through a third-party assessment plus technical verification. ★5 is still under study
• ★3 is valid for 1 year and ★4 for 3 years. The registration fee paid to IPA is ¥10,000 per year for ★3 (until the end of March 2028; ¥20,000 after that) and ¥60,000 for 3 years for ★4
• Certified organisations are listed on IPA's website and can use the logo mark
• Applications are scheduled to open in March 2027. The registration application guide is due at the end of November 2026, the list of assessment bodies in late December, and the list of experts from January 2027

Why it reaches tier-3 suppliers

The scheme's description says that "the outsourcer presents an appropriate level (★) to the supplier, encourages it to implement the measures and checks their implementation". That sounds like a matter between two companies, but reading the requirements shows that the scheme is designed to cascade.

• ★3 requirement 2-1-1: set up a mechanism to know the relationships between your own assets and systems managed by other organisations (suppliers, including customers, subsidiaries, affiliates and cloud providers)
• ★3 requirement 2-1-4: with suppliers that share confidential information, define the roles and responsibilities when an incident occurs
• ★4 requirement 2-1-3: from the viewpoint of business-continuity risk and information-management risk, know the security status of suppliers that could affect your company
• ★4 requirement 2-1-5: when a contract ends, recover confidential information and access rights from the supplier, or have them destroyed

In other words, a tier-1 supplier asked by a large company for ★4 must know its tier-2 suppliers' security status in order to keep ★4, and the simplest way to know it is to "have the tier-2 suppliers get a ★ too". Once a tier-2 supplier obtains ★3, its requirement 2-1-1 obliges it to know its relationships with tier-3 suppliers. Because category 2 of the requirements is "supplier management", the structure of the scheme is that the stars travel all the way to the end of the chain.

What happens if you do not meet it

IPA's FAQ says that "obtaining a ★ is voluntary" and that "not meeting every requirement does not mean business is stopped immediately". That is a correct description of the scheme's legal status.

Business reality is different. Large companies cannot do business with companies that do not meet their procurement standards. As soon as the standards say "suppliers must hold ★3 or higher under the SCS rating scheme", companies without it drop off the supplier shortlist. The person in charge has no discretion: contracting with a supplier that does not meet the standard would expose that person and the company to a compliance violation.

The design of the scheme reinforces this. A company holding ★4 is obliged to know its suppliers' security status, so it cannot keep suppliers whose status it cannot know. For new business it is a condition from the start; for existing business it is added at contract renewal. On public procurement, IPA says that "whether it becomes a tender requirement is up to the procuring body", but since this is a government scheme, it is reasonable to expect public-sector procurement to move first.

In short, it is voluntary by law and effectively mandatory in business. The gap between companies that prepare before their customers ask and companies that scramble afterwards will widen further once applications open and assessment bodies and experts are fully booked.

Five decisions for executives

Staff can take most requirements forward, but the following five points do not move until management decides them.

1. Which star to aim for. This depends on what your main customers will ask for. As a rule of thumb for now, ★4 if you deal directly with large companies, ★3 if you are a tier-2 supplier or below. You can also apply for ★4 directly without ★3
2. Which unit to certify. In the assessment sheet you choose the whole legal entity, part of it such as a business division, or the corporate group. The wider the scope, the higher the cost of the measures; the narrower it is, the more often you will have to explain to customers that "this division is out of scope"
3. Who is responsible. ★3 requirement 1-2-1 asks you to appoint the executive in charge of security (such as a CISO) and the department responsible, and to assign responsibilities and authority. ★4 additionally requires a body that can take management decisions, such as an information security committee with management participation (1-2-1-4)
4. Who makes the self-declaration of conformity. For both ★3 and ★4, management finally declares that "we conform to the requirements". Experts or assessment bodies check, but the responsibility for the declaration lies with management
5. By when. Applications open in March 2027. The industry rule of thumb is 2 to 3 months to implement the measures and 1 to 2 months to prepare the evidence. Work back from your customers' contract renewal dates to set a start date

The real cost and time

The registration fee paid to IPA looks cheap at ¥10,000 per year for ★3, but it is only part of the cost.

As for timing, the assessment sheet (the self-assessment template) is already published, so you can start assessing your current state now.

For small and medium-sized companies, IPA is preparing the "Cyber Security Otasuketai Service (new type)", a support service aimed at helping companies obtain ★3 and ★4 (still at the pilot stage as of October 2026).

What to do this month

There is no need to wait for applications to open. You can start on these four things this month.

1. Ask your main customers about their plans. Through your sales team, ask "which level of the SCS rating scheme do you plan to require from suppliers?" Their procurement departments are preparing too, and the earlier you ask, the more room you have to negotiate conditions
2. Appoint the person responsible. Set up the organisation required by requirement 1-2-1 and hand over the assessment sheet
3. Self-assess your current state. Just marking the 26 items as met or not met shows where the money will go. The items most companies trip over are end-of-support operating systems and software, missing multi-factor authentication, late updates and the absence of restore procedures
4. Check how your company looks from outside. Whether your website or server announces an old version can be checked, without registration, simply by entering a URL in Site Scouter's server information check. This "view from outside" is also the first thing a customer's procurement department looks at

For executives who will ask suppliers for a star

If your company is the main contractor and will ask suppliers for a ★, you need to decide the following:

• Which level to ask of which supplier. The scheme assumes that the required measures are "presented according to the supplier's position in the supply chain". You do not need to ask the same level of a supplier that holds your confidential information and of a supplier of generic parts
• Contract wording and grace periods. Applications open in March 2027, so you cannot make "already certified" a condition before then. A condition with a deadline, such as "obtain ★3 during fiscal 2027", is realistic
• The link to your own ★4. ★4 requirement 2-1-3 requires you to know your suppliers' security status. Asking suppliers for a ★ also becomes evidence for your own ★4
• What to do with your own checklists. One aim of the scheme is to end the burden on suppliers of different checklists from every outsourcer. Replacing the parts of your checklist that the ★ can cover makes it easier to win suppliers' cooperation

Beware of pushy sales pitches

In April 2026, the Ministry of Economy, Trade and Industry and the Cabinet Secretariat warned against inappropriate sales pitches that claim "you will not be able to do business without a rating" or "we are an accredited support organisation". There is no such role as an "accredited support organisation" in the scheme. The official roles are the four designated or registered by IPA: assessment bodies, technical verification providers, training providers and SCS security experts, and the lists will be published on IPA's website from December 2026. The requirements also do not ask you to install any particular security product. A proposal that "installing this product gets you the ★" does not match the scheme.

The difference between what section 3 of this article calls "effectively mandatory in business" and such sales pitches is the timing and the party. Until a customer writes it into its procurement standards, nobody can enforce it, and right now, before applications open, there is no basis for saying "sign today or you will be too late".

FAQ

Will tier-3 suppliers really need a ★?

The scheme works by an outsourcer presenting a level to its supplier, with no limit on how many tiers down it goes. Because ★4 requirement 2-1-3 requires knowing suppliers' security status, the more companies higher up obtain ★4, the stronger the incentive to ask companies further down for a ★.

Will we lose business if we do not get one?

IPA says that "obtaining a rating is voluntary" and that "business is not stopped immediately". On the other hand, once a customer writes ★ into its procurement standards, that customer cannot contract with companies that do not meet them. We recommend preparing on the basis that it is voluntary by law and effectively mandatory in business.

Who makes the self-declaration of conformity?

Management. After the expert's confirmation for ★3, or the assessment body's report for ★4, management declares conformity with the requirements and applies for registration.

If we have ISMS, do we still need it?

Yes. IPA's FAQ describes ISMS and the scheme as complementary. The rating also does not guarantee compliance with other legal frameworks or industry standards.

What is the total cost?

Apart from IPA's registration fee (¥10,000 per year for ★3, ¥60,000 for 3 years for ★4), nothing is in the scheme's fee table: experts and assessment bodies charge market prices, and the cost of the measures depends on your current state. Marking the self-assessment as met or not met gives you a rough idea of the cost of the measures.

References

Last checked: 2026-10-30. Specifications and policies can change; check the primary sources before acting.

• IPA: Security Rating Scheme for Strengthening Supply Chains (SCS rating scheme)
• IPA: Overview of the level-based assessment
• IPA: Requirements and evaluation criteria (SCS-400 Ver.1.1), assessment guides and handbook
• IPA: Frequently asked questions
• IPA: Fee notice (2026-09-18, PDF)
• IPA: Press release on the assessment guides (2026-10-28)
• METI: SCS rating scheme special site (scheme design policy)