Japan Supply Chain Security evaluation system implementation

The Japanese Ministry of Economy, Trade and Industry (METI) is promoting a Supply Chain Security (SCS) evaluation system to strengthen cybersecurity against rising ransomware and overseas threats. The framework utilizes a star rating system, ranging from self-evaluation at ‘Star 3’ to third-party assessments at ‘Star 4’. Companies have reported challenges regarding emergency personnel roles, overseas base management, and recovery training.

To support compliance, various industry players are offering resources such as webinars, data resilience maturity models, and ransomware cost compensation. The system is scheduled to begin operations by the end of fiscal year 2026. It is based on the NIST CSF 2.0 global standard and introduces stricter requirements for ‘supplier management’ regarding how companies oversee subcontractors. In response to these upcoming requirements, new cloud-based cyber exercise services have been launched to provide offensive and defensive training scenarios for talent development.

As the implementation approaches, Cyber Command Co., Ltd. has launched ‘KUMIHIMO AI. security,’ an AI-driven platform designed to help companies achieve the ‘Star 3’ rating. The platform is intended to assist organizations lacking dedicated security personnel by visualizing security status, automatically judging compliance with evaluation items, and providing instructions for improvements. It also features an ‘accompanying quick assessment’ service to help businesses identify priority tasks. While currently focused on the receiving side of transactions, the platform aims to eventually include ordering companies to standardize security visibility across the supply chain.