Where we work · Japan
ISO and GRC certification consulting in Japan
Achieve ISO and GRC certification in Japan with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Tokyo office team
- Effivity and Academy included
Sectors that ask for certification in Japan
Clients include
ISO and GRC certification in Japan at a glance
Demand for certification in Japan is driven less by statute than by procurement, supervisors and customers. The Personal Information Protection Commission supervises the Act on the Protection of Personal Information, which sets security duties without requiring any certificate. The Financial Services Agency's 2024 cybersecurity guidelines let financial institutions rely on third-party certification and assurance reports such as SOC 2 when reviewing suppliers, and ISMAP shapes cloud sales to government agencies. Card merchants follow the Credit Card Security Guidelines, which point to PCI DSS where card data is retained. Public works contractors are scored on ISO 9001 and on ISO 14001 or Eco-Action 21 in the Management Matters Review, and the Ministry of Health, Labour and Welfare aligned its medical device QMS ordinance with ISO 13485:2016. Management-system certificates come from certification bodies accredited by the Japan Accreditation Board or the ISMS Accreditation Center, never from Sterling. Demand is strongest among IT, SaaS and cloud providers, financial services suppliers, manufacturing and automotive supply chains, medical device and food makers, construction contractors and aerospace suppliers. Sterling's Tokyo office draws on 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Japan
Each page covers who needs the standard in Japan, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Japan (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Act on the Protection of Personal Information (APPI) Personal Information Protection Commission (PPC) | PPC supervises the Act across the private sector, administrative agencies, incorporated administrative agencies and local governments. Businesses handling personal information must take the necessary and appropriate measures for managing the security of personal data (Article 23), supervise employees (Article 24) and entrusted persons (Article 25), report leaks to the PPC in the cases prescribed by PPC order (Article 26), and follow restrictions on providing personal data to third parties in foreign countries (Article 28). Only the Japanese text has legal effect; the English translation is for reference. | |
| My Number Act Personal Information Protection Commission (shared responsibility with the Digital Agency) | Governs the Individual Number (My Number); entities that deal with My Number submit Specific Personal Information Protection Assessment reports. | |
| Financial Services Agency (FSA) Banks, insurers, securities firms and other financial institutions, and their critical third parties | Guidelines on Cybersecurity in the Financial Sector (金融分野におけるサイバーセキュリティに関するガイドライン, 4 October 2024) — third-party due diligence may rely on external evaluations (third-party assurance reports, third-party certification); vulnerability management of systems held by critical third parties may use third-party assurance reports such as SOC2 and contracts. ISO/IEC 27001 is not named. | SOC 2 |
| Ministry of Economy, Trade and Industry (Installment Sales Act); guidelines set by the Credit Transaction Security Council (secretariat: Japan Consumer Credit Association) Card merchants (face-to-face, e-commerce, mail and telephone order) and other businesses handling card numbers | Installment Sales Act (割賦販売法, Act No. 159 of 1961) and the Credit Card Security Guidelines version 6.0 — merchants either do not retain card information (non-retention) or, if they retain it, comply with PCI DSS; the guidelines are positioned in the supervisory policy under the Installment Sales Act as the practical guideline for the card-number protection measures the Act requires. | PCI DSS |
| Ministry of Health, Labour and Welfare (MHLW) / Pharmaceuticals and Medical Devices Agency (PMDA) Medical device marketing authorisation holders and registered manufacturing sites | MHLW Ministerial Ordinance No. 169 (QMS ordinance) — revised on 26 March 2021 to align with ISO 13485:2016. | ISO 13485 |
| Ministry of Health, Labour and Welfare (MHLW); prefectural and municipal food sanitation inspectors Food business operators | Food Sanitation Act (食品衛生法) as amended by the Act Partially Amending the Food Sanitation Act etc. (Act No. 46 of 2018) — from 1 June 2021, in principle all food business operators implement hygiene control in line with HACCP. | HACCP |
| Ministry of Health, Labour and Welfare (MHLW) Employers and workplaces | Guidelines on Occupational Safety and Health Management Systems (労働安全衛生マネジメントシステムに関する指針), published under Article 24-2 of the Industrial Safety and Health Regulations; revised (applied from 1 July 2019) in light of ISO 45001, adopted as JIS Q 45001, and JIS Q 45100 issued in September 2018. | ISO 45001 |
| Cabinet Office (Disaster Management) All businesses (business continuity) | Business Continuity Guidelines (事業継続ガイドライン, March 2023 revision) — list ISO 22301 among reference documents and state that the guidelines are not intended to set out the necessary and sufficient conditions for ISO 22301 certification. | ISO 22301 |
| Ministry of Economy, Trade and Industry (METI) Specified business operators (large energy users) | Act on the Rationalisation of Energy Use and Shift to Non-fossil Energy (エネルギーの使用の合理化及び非化石エネルギーへの転換等に関する法律) — specified business operators appoint an energy management control officer (エネルギー管理統括者) and prepare medium- to long-term plans; the Act does not name ISO 50001. | |
| Cabinet Office (AI Strategy Headquarters) Developers and users of artificial intelligence | AI Act (人工知能関連技術の研究開発及び活用の推進に関する法律) — promulgated and partly in force on 4 June 2025, fully in force from 1 September 2025; aims to promote AI innovation while addressing risks; does not name ISO/IEC 42001. | |
| Ministry of Economy, Trade and Industry (METI) Companies engaged in international commercial transactions | Unfair Competition Prevention Act (不正競争防止法, Act No. 47 of 1993), Article 18 — prohibits giving, offering or promising money or other benefits to foreign public officials to obtain an improper business advantage in international commercial transactions; ISO 37001 is not named. | |
| Ministry of the Environment Small and medium-sized businesses (environmental management) | Eco-Action 21 — the Ministry's simplified scheme integrating an environmental management system, environmental performance evaluation and environmental reporting, revised in 2004 for use in a certification and registration scheme. |
Accreditation and recognition
- Japan Accreditation Board (JAB): Accreditation body; accredits management-system certification bodies across multiple ISO standards, testing, medical and calibration laboratories, inspection bodies, proficiency testing providers, reference material producers and product certification bodies.
- ISMS Accreditation Center (ISMS-AC): Accreditation body for certification bodies for ISMS (ISO/IEC 27001), ITSMS (ISO/IEC 20000-1), BCMS (ISO 22301) and CSMS, with ISMS cloud security and ISMS-PIMS certification variants, and AIMS (ISO/IEC 42001); independent legally incorporated association since April 2018, originating in the JIPDEC scheme operated from 2002.
- International Accreditation Japan (IAJapan), National Institute of Technology and Evaluation (NITE): Accreditation body for JCSS calibration laboratories under the Measurement Act and ISO/IEC 17025, JNLA testing laboratories and ASNITE; JCSS and ASNITE calibration are within the scope of the ILAC/APAC MRA.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Cities
Tenders and procurement
- Management Matters Review (経営事項審査) for public works contractors (Ministry of Land, Infrastructure, Transport and Tourism (MLIT)): Item W8 (registration under standards set by the State or ISO) scores quality management (ISO 9001) and environmental management (ISO 14001 or Eco-Action 21, Eco-Action 21 added in the revision applied from 1 January 2023).
- Unified qualification for competitive bidding (全省庁統一資格) — goods and services (Central government ministries (applications through the government procurement portal; Ministry of Finance local bureaus)): Registration for non-construction government contracts under a common screening standard used by all ministries since FY2001. The page does not list ISO certificates; any certificate requirement is set in the individual tender.
- ISMAP (Information system Security Management and Assessment Program) (National center of Incident readiness and Strategy for Cybersecurity, Digital Agency, Ministry of Internal Affairs and Communications, Ministry of Economy, Trade and Industry): Government agencies and related agencies are, in principle, required to procure cloud services from the ISMAP Cloud Service List. ISMAP control criteria incorporate the JIS Q 27000 series (JIS Q 27001, 27002, 27014, 27017), the Government Common Standards and NIST SP800-53.
Economic zones
- National Strategic Special Zones: business start-up, urban redevelopment, medical, agriculture, tourism
Sterling in Japan
Sterling delivers in Japan from its Tokyo office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Japan, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Japanese clients ask
Are certification audits in Japan conducted in Japanese or English?
Either language can be used, but Japanese is the working language of most organisations and of the JIS Q editions of the management-system standards. Settle the audit language, Japanese or English, and the language of controlled documents and records with the certification body when you apply. Follow any language requirement set by your customer or regulator as well.
Does the APPI require ISO 27001, ISO 27701 or PrivacyMark?
No. The APPI's Article 23 requires necessary and appropriate measures for managing the security of personal data, and it does not call for a certificate of any kind. PrivacyMark and ISO/IEC 27701 are voluntary, so choose them only if customers or your own risk review want an external benchmark. Confirm the detail with your counsel or the Personal Information Protection Commission.
Which accreditation body should an ISO 27001 certification body in Japan hold?
ISMS-AC is the accreditation body for ISO 27001 certification bodies in Japan, and the Japan Accreditation Board also accredits management-system certification bodies across several ISO standards. A body accredited by another accreditation body inside the international mutual recognition arrangements is a further option. Ask any body for its accreditation scope before applying.
Do Japanese public works bids score ISO certificates?
Yes, in the scoring of public works. Item W8 of the Management Matters Review, run for contractors by the Ministry of Land, Infrastructure, Transport and Tourism, scores ISO 9001 for quality and either ISO 14001 or Eco-Action 21 for environmental management. This applies to public works contractors only, so check each tender's own criteria before relying on it elsewhere.
Do cloud providers selling to Japanese government agencies need ISMAP?
In principle, yes. Government agencies are expected to procure cloud services from the ISMAP Cloud Service List, so a provider selling to them normally needs to be on it. ISMAP's control criteria are built on the JIS Q 27000 series, which makes an ISMS a useful base. Check with the ISMAP owners which agency purchases are covered.
When should audits be scheduled around Japanese holidays?
Plan around the New Year holidays, the cluster of public holidays from late April into early May, and the mid-August Obon period. All three affect how certification bodies and client teams schedule audits. Exact dates change every year, so ask the certification body for its calendar well ahead and do not assume fixed dates.
Cities Sterling covers in Japan
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Act on the Protection of Personal Information (APPI) — japaneselawtranslation.go.jp; ppc.go.jp (accessed 5 Oct 2026)
- My Number Act — ppc.go.jp (accessed 5 Oct 2026)
- Guidelines on Cybersecurity in the Financial Sector (金融分野におけるサイバーセキュリティに関するガイドライン, 4 October 2024) — fsa.go.jp (accessed 5 Oct 2026)
- Installment Sales Act (割賦販売法, Act No. 159 of 1961) and the Credit Card Security Guidelines version 6.0 — j-credit.or.jp; laws.e-gov.go.jp (accessed 5 Oct 2026)
- MHLW Ministerial Ordinance No. 169 (QMS ordinance) — pmda.go.jp (accessed 5 Oct 2026)
- Food Sanitation Act (食品衛生法) as amended by the Act Partially Amending the Food Sanitation Act etc. (Act No. 46 of 2018) — mhlw.go.jp (accessed 5 Oct 2026)
- Guidelines on Occupational Safety and Health Management Systems (労働安全衛生マネジメントシステムに関する指針), published under Article 24-2 of the Industrial Safety and Health Regulations; revised (applied from 1 July 2019) in light of ISO 45001, adopted as JIS Q 45001, and JIS Q 45100 issued in September 2018 — mhlw.go.jp (accessed 5 Oct 2026)
- Business Continuity Guidelines (事業継続ガイドライン, March 2023 revision) — bousai.go.jp (accessed 5 Oct 2026)
- Act on the Rationalisation of Energy Use and Shift to Non-fossil Energy (エネルギーの使用の合理化及び非化石エネルギーへの転換等に関する法律) — laws.e-gov.go.jp (accessed 5 Oct 2026)
- AI Act (人工知能関連技術の研究開発及び活用の推進に関する法律) — www8.cao.go.jp (accessed 5 Oct 2026)
- Unfair Competition Prevention Act (不正競争防止法, Act No. 47 of 1993), Article 18 — laws.e-gov.go.jp (accessed 5 Oct 2026)
- Eco-Action 21 — env.go.jp (accessed 5 Oct 2026)
- Japan Accreditation Board (JAB) — nite.go.jp; ilac.org (accessed 5 Oct 2026)
- ISMS Accreditation Center (ISMS-AC) — isms.jp (accessed 5 Oct 2026)
- International Accreditation Japan (IAJapan), National Institute of Technology and Evaluation (NITE) — nite.go.jp (accessed 5 Oct 2026)
- Management Matters Review (経営事項審査) for public works contractors — ktr.mlit.go.jp (accessed 5 Oct 2026)
- Unified qualification for competitive bidding (全省庁統一資格) — goods and services — lfb.mof.go.jp (accessed 5 Oct 2026)
- ISMAP (Information system Security Management and Assessment Program) — ismap.go.jp (accessed 5 Oct 2026)
- National Strategic Special Zones — chisou.go.jp (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Tokyo team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
japan@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice