Wiz and ISMAP: How We Are Preparing to Serve Japan's Public Sector
When Japanese government agencies procure cloud services, they are required, in principle, to procure from services registered on the ISMAP Cloud Service List. This list is established under ISMAP (Information system Security Management and Assessment Program), in accordance with the "Common Standards for Cybersecurity Measures for Government Agencies and Related Agencies. ISMAP is a framework that evaluates and registers cloud services in advance to ensure they satisfy the security requirements mandated by the government.
Without an active ISMAP listing, Japanese government agencies face a barrier to adoption. While Wiz is not listed on ISMAP yet, we're actively working through the controls and wanted to share where we actually stand today.
What ISMAP Is, and Why It Matters
In practice, ISMAP gives procurement officers a pre-vetted catalog of cloud providers. Getting onto that list comes with strict baseline demands:
- Mandatory external audits conducted by audit firms registered on the ISMAP Auditors List
Mandatory external audits conducted by audit firms registered on the ISMAP Auditors List
- Japanese-language application support, along with the preparation of documentation and audit trails required for review and examination
Japanese-language application support, along with the preparation of documentation and audit trails required for review and examination
- Post-registration adherence to scheduled renewal applications and ongoing audits and verifications
Post-registration adherence to scheduled renewal applications and ongoing audits and verifications
Under the hood, ISMAP complements established global standards. The ISMAP Control Measures are built around the Common Standards for Government Agencies as well as JIS Q 27001 and JIS Q 27017, the Japanese national standards for ISO/IEC 27001 and ISO/IEC 27017, covering information security management and cloud security controls. While ISMAP aligns with these frameworks, holding these certifications does not directly equate to ISMAP registration. Additionally, ISMAP also pulls in ISO/IEC 27018 for cloud privacy, alongside NIST SP 800-53 controls to plug edge cases that the core ISO standards do not explicitly cover.
Currently, proposed revisions to the ISMAP Control Measures have been published, focusing on reflecting revised international standards and streamlining the number of control measures. These proposals aim to reorganize and rationalize the control system, which is expected to enhance efficiency upon revision and enforcement while maintaining the security and reliability demanded by the program. Please note that the draft revisions and implementation schedule remain subject to change.
Where Wiz Stands Today
Wiz has maintained active ISO 27001, ISO 27017, ISO 27018, SOC 2, PCI DSS, and FedRAMP certifications and reports for the past five years. Our commitment to compliance gives our teams established practices for control implementation, evidence collection, and continuous audit readiness. We recently finished an internal gap assessment against both the current ISMAP Control Measures and the published revision proposals to prepare for the upcoming ISMAP audit.
To address the specific requirements of the ISMAP framework, we are actively building out the localized evidence packages and formal processes required for ISMAP assessors. In parallel, we have engaged with an audit firm registered on the ISMAP Auditors List, with target plans to formally launch the external assessment audit in early 2027.
What This Means for Customers
To be clear: ISMAP does not offer an official "in progress" or provisional status. You're either on the official registry or you are not–and right now, we are not.
What we can confirm is that we are executing our ISMAP-specific requirements by leveraging our extensive experience with certifications such as ISO 27001, SOC 2 Type II, PCI-DSS, FedRAMP, IRAP, and CPSTIC. We have completed the gap analysis, engaged with registered assessors, and are addressing control artifacts ahead of time rather than scrambling during the audit window.
In the meantime, security teams in Japan already use Wiz to audit and enforce the core security areas: IAM, data encryption, centralized logging, continuous vulnerability scanning, and incident response. However, compliance with ISMAP security standards is not verified or guaranteed solely by the use of Wiz.
Looking Ahead
Our roadmap is straightforward: finalize the contract with an assessment body and formally commence the external ISMAP assessment audit in early 2027. We will share further updates as we hit key audit milestones over the next year.
If you are navigating Japanese public sector compliance today, we can walk you through our current security posture, share our active ISO and SOC 2 reports, and show you how our existing control mapping aligns with ISMAP. Reach out to your Wiz account team or contact us directly.
