The latest ISMAP updates (proposed for official release ~May 2027) modernize the framework by aligning it with ISO/IEC 27001:2022 and reorganizing the control structure. The updates to the program regulations incorporate the revisions of the Japanese Industrial Standard (JIS standards) which in turn reflect changes to programmatic documents such as the ISMAP Management Standards and guides. This streamlined structure introduces clearer cloud-specific requirements and establishes a default expectation that all controls are implemented, by default, unless a strongly justified risk-based decision is provided. The shift is designed to increase consistency across cloud service providers and simplify how organizations understand and apply ISMAP’s security expectations.
Control chapters which were previously organized from 5-18 are now being reduced from fourteen (14) categories into five (5) categories. The organization of these controls now encompasses categories for organizational management measures, human management measures, physical control measures, technical control measures, and cloud-specific management measures. The reduction in categories has also reduced the total number of controls from 1,081 control measures to roughly 253 control measures (a total of 322 control measures when including the Governance and Management criteria). The newly released baseline controls will also include supplemental controls that can increase the number of controls by default. The final number of control measures will be known once published and released for official use.
To support this model, ISMAP is developing new guidelines that clarify how to justify control exclusions, select appropriate controls, and apply threat-based prioritization. A preassessment mechanism is also under consideration to help providers validate their decisions before undergoing a formal audit. These improvements are intended to reduce compliance complexity, particularly for SaaS services, and to better integrate ISMAP audits with existing certifications to minimize redundant work.
Collectively, these updates aim to lower costs and entry barriers for cloud service providers while making ISMAP more practical, predictable, and scalable. By streamlining controls, providing clearer guidance, and exploring a lighter, SaaS focused variant, the revised framework is positioned to encourage broader adoption across the cloud ecosystem.
Timeline of expected events (subject to change by the IPAs consideration):
- December 2025: Publication of the draft revisions to the ISMAP Management Standards
- January 2026-May 2027 (previously March 2027): Work towards the formulation of the guidelines and the revision of related regulations to include the formalization of the preliminary confirmation framework. Inquiries or opinions are gathered by the IPA from stakeholders.
- May 2027: Formulation and publication of the OFFICIAL guidelines and release for public consumption and use. Revisions will include the updated ISMAP Management Standards.
- May 2027 going forward: Enforcement of the revised ISMAP Management Standards (ongoing ISMAP efforts will be considered by the IPA depending on the scheduling/release and determining alignment with IPA). Implementation of parallel operations of both the old, and new Standards by the IPA. The current implementation period is under consideration for review and analysis by the IPA. The structure of the framework is continuously going to change based on feedback and consideration by the IPA and governing bodies.
This is part 2 of a 2-part series on understanding ISMAP. See part 1 here: What is ISMAP? Understanding Japan’s Government Standard for Secure Cloud Services
Sources:
- Proposed Revision of ISMAP Management Standards: https://www.ismap.go.jp/csm?id=kb_article_view&sys_kb_id=282aed782bbdb290f0bbfd69fe91bfce
About the Author
