ISMAP

ISMAP is the Japanese government's cloud security framework that is mandatory for cloud service providers (“CSPs”) to serve public sector organizations.

The program's goal is to ensure a consistently high level of security for government cloud procurement which includes:

• ISMAP - A joint initiative managed by four Japanese government organizations: the National Cybersecurity Office (“NSO”), the Digital Agency (“DA”), the Ministry of Internal Affairs and Communications (“MIC”), and the Ministry of Economy, Trade and Industry (“METI”).
• The program involves a rigorous assessment against approximately 1,200 security, governance, and management controls. These controls are based on multiple international standards, including ISO 27001 and the NIST SP 800-53 framework (used in the US FedRAMP program).
• After a successful third-party auditor assessment and ISMAP Steering Committee examination, the CSP is registered on the ISMAP Cloud Service List. Government agencies are generally required to select services from this official list.

For more information, visit the ISMAP Official Portal Site.

Yes, Cloudflare is an ISMAP-registered Cloud Service Provider.

Our successful registration confirms that an independent, third-party auditor has assessed and the ISMAP Steering Committee examined our services and verified that our security controls meet the comprehensive ISMAP security and compliance requirements.

Cloudflare’s ISMAP registration provides several key benefits:

• The ISMAP assessment validates that Cloudflare for Government - Japan meets the stringent security standards set by the Japanese government.
• Using Cloudflare’s ISMAP registered services helps your agency meet its required Japanese government compliance mandates.
• ISMAP uses a shared responsibility model. As a registered provider, Cloudflare maintains many of the foundational security controls. Your agency can inherit these controls, leading to efficiency and reduced complexity in your own compliance efforts.
• The successful assessment confirms that Cloudflare has undergone a rigorous security review, making our services demonstrably suitable for use in Japanese government operations.

The following Cloudflare services are included in our Cloudflare for Government - Japan offering:

Application Services:
API Shield, Bot Management, DDoS Protection, Rate Limiting, SSL/TLS, SSL/TLS for SaaS, Turnstile, WAF, CDN, DNS, Load Balancing, Waiting Room

Developer Services:
Cloudflare for SaaS, Workers

Network Services:
Magic WAN, Magic Transit, Magic Firewall, Network Interconnect, Spectrum

Zero Trust Services:
Access, Cloudflare Tunnel, Browser Isolation, CASB, Gateway, Zero Trust WARP Client

Analytics and Insights:
Logpush

Privacy and Compliance:
Data Localization - the following regions are in scope: Japan (Tokyo and Osaka).

Cloudflare continuously introduces new features/functions across our platform throughout the year, some of which may have not been included in the current ISMAP assessment. Cloudflare may add these to our ISMAP assessment scope depending on the annual assessment cycle.

Cloudflare's registration as an authorized provider ensures the security of the services we provide as the CSP. However, achieving compliance is a shared responsibility. Your agency remains responsible for implementing and managing security controls related to your configuration, the data you process, and your use of Cloudflare services to meet the complete set of ISMAP requirements. Cloudflare provides a Customer Responsibility Matrix within the documentation package to help you understand your specific obligations.

Cloudflare provides a Customer Responsibility Matrix within the documentation package to help you understand your specific obligations.

ISMAP registration is available from the official ISMAP cloud services list.

Cloudflare’s ISMAP assessment cycle occurs every year. Customers can check status by the official ISMAP cloud services list.

Visit Cloudflare’s Trust Hub to learn about additional compliance resources.

Learn more about how Cloudflare’s connectivity cloud capabilities help enterprises streamline and map to compliance requirements across multiple standards by visiting our data compliance and protection page.