- The four documents published on October 28 and what comes next
- How 3 stars and 4 stars differ: threats, checks, fees and renewal
- Whether it is mandatory, and how to respond when a customer asks
- What a small business can do before the scheme starts
Short answer
The SCS scheme rates a company's security measures with stars, to raise the level across whole supply chains, including business partners. On October 28, 2026, IPA, which runs it, published guides that set out the assessment procedures and a commentary explaining the requirements. IPA says it is preparing for the scheme to start in March 2027. Getting a rating is voluntary, but customers are likely to ask for one more often. Reading the requirements now and sorting what you already do from what you do not will save you a scramble later.
What was published
The four documents published on October 28 are a self-assessment guide for 3 and 4 stars, a third-party assessment guide for 4 stars, a technical verification guide for 4 stars, and a commentary on the requirements and assessment criteria for 3 and 4 stars. A company aiming to register should start with the self-assessment guide and the commentary. Next come a registration guide and a scheme logo, and assessment bodies and others are due to be designated and announced in late December 2026.
How 3 and 4 stars differ
Based on IPA's FAQ:
- Threats assumed: 3 stars covers common cyber attacks; 4 stars covers attacks that would have a major impact by stopping supply or leaking information
- How it is checked: for 3 stars, an "SCS security expert" confirms your self-assessment; for 4 stars, an assessment body carries out a third-party assessment and technical verification
- Renewal: 3 stars every year, 4 stars every three years
- Registration fee to IPA: 20,000 yen for 3 stars (10,000 yen until March 31, 2028); 60,000 yen for 4 stars
You are not required to install particular products such as EDR (software that watches computers for suspicious behaviour) or asset management systems. It is not something you can get by buying a product. 4 stars depends on how important your role is to customers, not on company size, so even a small firm may be asked for it.
Besides the registration fee, the experts or assessment bodies you hire will charge for their work. Check the price with each one.
Is it mandatory?
The FAQ states that obtaining stars is voluntary. Whether to make it a condition of business is up to the parties to the contract, and failing to meet every requirement is not in itself grounds to demand that business stop immediately. Whether it becomes a condition for public tenders is up to each procuring body.
If a customer asks you for 3 stars, ask which level, by when, and whether it applies to the whole company or only the part involved in their business. Until you have it, the FAQ also envisages using the requirements as a shared checklist to show where you stand. When you are the one asking a contractor for stars, use the same thinking: set a reasonable level based on how sensitive the information you entrust to them is.
What to do before the scheme starts
Checklist
- Have you read IPA's requirements and commentary, and sorted items into done, doable with some work, and needing major work?
- Do you have a list of your computers, servers, cloud services and accounts?
- Is it decided who applies fixes, takes backups and removes leavers' accounts, and when?
For small businesses, a new type of "Cyber Security Otasuketai" support service aimed at helping firms obtain 3 or 4 stars has also been set out.
IPA says it takes enquiries by email only and does not handle them by phone. If a caller claiming to be from IPA asks you to get a rating or pay a fee, check the guidance on IPA's official website.
One thing to check today
Open IPA's SCS scheme page, find the requirements and assessment criteria document, and name one person in charge.