Print / Save PDF

What ISMAP is

The Information system Security Management and Assessment Program (ISMAP) “aims to secure the security level of the government's cloud service procurement by evaluating and registering cloud services that meet the security requirements of the government in advance, thereby contributing to the smooth introduction of cloud services.” [1]

Cloud services that pass assessment are registered on the ISMAP Cloud Service List. “In principle, procurement ministries and agencies will procure cloud services from those listed on the ISMAP Cloud Service List.” [1]

The ISMAP Steering Committee “registers in the ISMAP Audit Institutions List those institutions that have been identified as meeting the requirements for audit institution registration applicants.” Cloud service providers “request audits from audit institutions registered in the ISMAP audit institution list.” [1]

The National Cybersecurity Office describes ISMAP as the program that evaluates and registers cloud services that meet government security requirements so government agencies (ministries and independent administrative agencies) can introduce those services. The Independent Administrative Agency Information-technology Promotion Agency (IPA) provides operational support on the ISMAP portal. [2]

Open the official pages: ISMAP Overview · National Cybersecurity Office ISMAP page · ISMAP audit institution list.

Registered audit institutions

The official ISMAP audit institution list had 8 institutions when captured on 2026-10-27. Agent Index lists 6 Verified · 2 registry-listed of those 8. Japanese registered name, registration number, dates and the registry remark come from the official export (and each firm’s stored registry_listings / accreditations[].status_text). [4] [3]

A26-0008 一般社団法人日本セキュリティ格付機構 (Japan Security Rating Organization / JaSRO) is a general incorporated association already on the official list and already in this directory as a Verified profile. It is not an audit firm in the same sense as the other seven rows, and this update does not add a second profile for it.

ISMAP audit institutions in Japan (8 firms with a Japan office).

A20-0001 through A20-0004 show valid_until 2026-08-19 on the official list. Their remarks say a renewal application has been filed, so registration remains valid after that date. Those four rows are recorded as listed (not expired). A25-0006 valid_until 2027-12-21; A26-0007 valid_until 2028-04-23; A26-0008 valid_until 2028-06-25.

Related: auditors directory · auditors in Japan · Check an Auditor · ISO 27001 certification bodies.

How to verify

1. Search the official ISMAP audit institution list for the exact legal entity and registration number.
2. Confirm the same name on Check an Auditor.

Get matched

If you want a shortlist of listed firms for ISMAP or another published framework, use Get matched or the form below. We store the request for review; we do not email firms automatically.

Get matched

FAQ

How many ISMAP audit institutions are listed here?

The official ISMAP audit institution list had 8 institutions on 2026-10-27 (no as-of date on the page; fetch date used). This directory lists 6 Verified · 2 registry-listed of those 8.

Where is the official list?

The official ISMAP audit institution list is published on the ISMAP portal. Confirm the legal entity there before engaging a firm. Official ISMAP audit institution list.

Is ISMAP the same as ISO 27001?

ISMAP is a separate Japanese government program. None of the 8 listed firms currently show an ISO-related accreditation on their Agent Index profile.

Sources

1. ISMAP Overview, ISMAP portal (KB0010301), checked 27 Oct 2026. https://www.ismap.go.jp/csm?id=kb_article_view&sysparm_article=KB0010301
2. National Cybersecurity Office, ISMAP page, checked 27 Oct 2026. https://www.cyber.go.jp/policy/group/general/ismap.html
3. ISMAP audit institution list. https://www.ismap.go.jp/csm?id=audit_institution_list
4. Agent Index auditors dataset v0.1.32, generated 2026-10-27. https://theagentindex.io/auditors.json

Prepared by Agent Index (Heritage Services). Last reviewed 27 Oct 2026. General information, not legal advice. Confirm scope with your counsel or auditor. Licensed CC BY 4.0.