Your Company's Security Gets a Star: Japan's SCS Rating Scheme Explained Simply (★3 and ★4, Costs, Timeline)

"Could your company get ★3 as well?" From spring 2027, more and more companies in Japan will hear this from their customers. The star comes from the SCS rating scheme, created by the Japanese government (the Ministry of Economy, Trade and Industry and the Cabinet Secretariat) and run by IPA (the Information-technology Promotion Agency, Japan). Its official name is the "Security Rating Scheme for Strengthening Supply Chains". On 28 October 2026, the assessment guides and the explanatory handbook were published, and the scheme is now almost fully defined.

This article explains, with as little IT jargon as possible, why the scheme exists, what the stars mean, what happens when you get one, how much it costs and when it starts. The technical details (what exactly to configure) are in the guide for engineers, and the business impact and management decisions are in the guide for executives. There is also a manga edition you can read with your children.

Also published on the author's blog nkzw.jp.

Why the "supply chain"?

In recent years there have been repeated incidents in which it was not the large company itself but one of its suppliers or subsidiaries that was attacked, and the large company's factories or logistics stopped. If just one company in the chain is breached, whether it supplies parts, maintains systems or holds data, the damage spreads to every company connected to it. This is a "supply-chain attack".

Until now, large companies have checked their suppliers by sending them their own checklists. For the small and medium-sized companies on the receiving end, that means answering similar questions again and again in a different format for every customer, which is a heavy burden. The senders, for their part, are not sure their checklists are adequate. The aim of the scheme is to solve both problems with a common yardstick set by the government.

The important point is that this yardstick reaches not only the companies that deal directly with large companies, but also their tier-2 and tier-3 suppliers further down. A company that obtains ★4 becomes obliged to know the security status of its own suppliers (requirement 2-1-3). The easiest way to know it is to "ask suppliers to get a star too", so the demand for stars flows further and further down the chain.

The stars show "how well you are protected"

There are three levels: ★3, ★4 and ★5. There is no ★1 or ★2 (the one-star and two-star commitments of IPA's separate programme, "SECURITY ACTION", serve as the foundation). ★5 is still under study, so for now ★3 and ★4 are the ones in actual use.

The 26 and 43 items fall into 7 broad areas: "appoint the people responsible", "know your relationships with suppliers", "know which computers and servers you have", "prevent attacks", "notice attacks", "respond when something happens" and "restore the business". That may sound technical, but much of ★3 is about showing in documents that you have set rules, told your staff about them and review them once a year.

Examples of what ★3 actually asks for

From the documents written for specialists, here are the items most relevant to ordinary business owners:

• Appoint the people responsible. Name the executive in charge of security and the department responsible, and keep a contact list
• Keep a register of computers and servers: how many there are and which operating system each runs
• Password rules. Always change initial passwords, ban easily guessed words, never reuse passwords. At least 8 characters (at least 10 if there is no lockout or two-step verification)
• Always use two-step (multi-factor) authentication for cloud services that handle important information
• Install updates within 14 days of their release (for serious ones). Stop using old software that is out of support, or cut it off from the internet
• Install antivirus software on every computer and server
• Back up your data, keep important information in a separate location as well, and write down how to restore it
• Change the management passwords of routers and firewalls so that nobody can get in from outside
• Decide in advance what to do and whom to contact when an incident happens (including customers, the police and the supervising ministry)

You are not required to buy any particular security product. A sales pitch saying "you cannot get the star without this product" does not match what the scheme says.

How to get a star

For ★3

1. Decide whether to apply for the whole company, for one business division or for the group
2. Fill in the results of your own check of the 26 items in the assessment sheet (an Excel file) provided by IPA
3. Have an SCS security expert registered with IPA confirm it and sign it
4. The president or other management makes a self-declaration of conformity that "we meet the requirements"
5. Apply to IPA for registration. After review, your company is listed on IPA's website and can use the logo mark

For ★4

After step 2, instead of an expert's confirmation, you engage an assessment body. The assessment body reviews your documents, visits for an on-site audit of 1 to 2 days, and then spends 1 to 2 days testing the devices that can be reached from outside over the internet (VPN appliances, routers and so on) for weaknesses. If a serious weakness is found, you fix it within 14 days and have it tested again. Once you receive the assessment report, you move on to the self-declaration and the registration application.

How much does it cost?

The registration fee paid to IPA is shown in the table above: ¥10,000 per year for ★3. However, the fees paid to experts and assessment bodies are separate. They are not in the scheme's fee table and are set by the market.

Another thing that is often overlooked is the cost and time of the security measures themselves. Introducing two-step verification, replacing old computers and software, and setting up backups can take several months depending on the size of the company. In the industry, a rule of thumb of "2 to 3 months for the technical measures, 1 to 2 months for the documents and evidence" is often mentioned.

For small and medium-sized companies, IPA is preparing the "Cyber Security Otasuketai Service (new type)", a support service aimed at helping them obtain ★3 and ★4 (still at the pilot stage as of October 2026).

When does it start?

There are about 5 months until applications open, but since the measures take several months, companies whose customers are likely to ask should start checking their current state now to be just in time. The assessment sheet can already be downloaded.

What happens if you don't get one?

Once a customer's procurement standards say "★3 or higher", companies without it will no longer be chosen as suppliers. Large companies cannot sign contracts with companies that do not meet their own procurement standards. The person in charge has no discretion, because contracting with a company that does not meet the standard would be a compliance violation. For new business it is a condition from the start; for existing business it is added when the contract is renewed. And as we saw in section 1, the requirement does not stop at the tier-1 supplier but comes all the way down to tier-2 and tier-3 suppliers.

Legally, the scheme is voluntary. IPA's FAQ says that "obtaining a star is voluntary" and that "not meeting every requirement does not mean business is stopped immediately". Whether it becomes a requirement in public tenders is up to each procuring body. Still, the realistic approach is to prepare on the basis that it is "voluntary by law, effectively mandatory in business". Knowing now how far your company already meets the requirements makes both negotiation and preparation easier than scrambling after a customer asks.

Beware of pushy sales pitches

In April 2026, the Ministry of Economy, Trade and Industry and the Cabinet Secretariat issued a warning about inappropriate sales pitches that claim "you will not be able to do business without a star" or "we are an accredited support organisation". There is no such role as an "accredited support organisation" in the scheme. The only official roles are the four designated or registered by IPA: assessment bodies, technical verification providers, training providers and SCS security experts. The lists will be published on IPA's website from December 2026.

You can check whether a name or title is genuine against the lists on IPA's website. At this point, before the lists are published, no company can legitimately claim to be "accredited".

First, check how your company looks from outside

The requirements include installing updates within 14 days and not using software that is out of support. Whether your website or server announces an old version to the outside world can be checked, without registration, simply by entering a URL in Site Scouter's server information check. Use it as a one-minute first check before you start preparing for the star.

FAQ

Does it apply to small companies too?

It applies regardless of industry or size. IPA expects the biggest benefit for small and medium-sized companies with limited people and budget for security.

Does it matter to tier-3 suppliers that do not deal directly with large companies?

Yes. A company that obtains ★4 is obliged to know its suppliers' security status, so the more companies higher up get stars, the more companies further down are asked for them. There is no limit on how many tiers down it goes.

Can I apply for ★4 without ★3?

Yes. A higher star contains all the requirements of the lower ones, so you can apply for ★4 directly.

If I have ISMS or the PrivacyMark, do I still need it?

Yes. IPA's FAQ describes ISMS and the scheme as complementary.

Are certified companies made public?

Yes. Registered organisations are listed on IPA's website and can use the logo mark.

Where can I ask questions?

The Security Certification Group of IPA's Security Center accepts questions by email. Telephone enquiries are not accepted.

References

Last checked: 2026-10-30. Specifications and policies can change; check the primary sources before acting.

• IPA: Security Rating Scheme for Strengthening Supply Chains (SCS rating scheme)
• IPA: Overview of the level-based assessment
• IPA: Requirements, evaluation criteria and assessment guides
• IPA: Frequently asked questions
• IPA: Fee notice (2026-09-18, PDF)
• IPA: Press release on the assessment guides (2026-10-28)
• METI: SCS rating scheme special site
• IPA: SECURITY ACTION