Japan ISMAP

Information system Security Management and Assessment Program - cloud service registration for government.


Short name	ISMAP
Region	Asia-Pacific
Country or scope	Japan
Sector	Cloud
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers ISMAP

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for ISMAP.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for ISMAP and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`JP-ISMAP-ASSET` Cloud Asset Inventory	Registered cloud services must maintain an inventory of information assets, including the software components the service is built from (ISMAP control standards, asset-management controls derived from ISO/IEC 27002)	Scan
`JP-ISMAP-CONF` Configuration and Change Management	Changes to systems must be controlled and configurations documented, which requires the version of every deployed component to be recorded (ISMAP control standards, change/configuration management controls)	Scan
`JP-ISMAP-VULN` Technical Vulnerability Management	Service providers must obtain and act on information about technical vulnerabilities of systems in use, which requires standard component identifiers to match vulnerability advisories (ISMAP control standards, technical vulnerability management controls)	Scan
`JP-ISMAP-INTEG` Software Integrity Controls	Controls against malware and unauthorised software require verification that deployed software is authentic, evidenced by cryptographic hashes on components (ISMAP control standards, malware-protection and software-installation controls)	Scan
`JP-ISMAP-SUP` Supplier Relationship Security	Security requirements must be managed across supplier relationships and the cloud supply chain, which requires the supplier of each software component to be named (ISMAP control standards, supplier-relationship controls derived from ISO/IEC 27017)	Scan
`JP-ISMAP-DOC` Assessment Evidence Records	ISMAP registration and annual reassessment depend on documented, auditable evidence, so machine-readable records must carry a document identity and creation timestamp (ISMAP registration and assessment rules)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`ISMAP-GOV`	Information Security Governance
`ISMAP-A5-A8`	Organisational & Asset Controls
`ISMAP-A9-A12`	Access, Cryptography & Operations Controls
`ISMAP-A13-A14`	Communications & System Acquisition Security
`ISMAP-A16-A18`	Incident Management, BCM & Compliance
`ISMAP-NIST-AC`	NIST 800-53 Access Control Overlay
`ISMAP-CLOUD-OPS`	Cloud Provider Operational Obligations

Policy templates

Written for ISMAP:

ISMAP Cloud Service Onboarding Procedure

And 22 from the standard set, adapted to ISMAP.