Information system Security Management and Assessment Program (ISMAP)

Assessors registered on the ISMAP Assessor List are required to conduct information security assessments compliant with the standards and procedures prescribed under ISMAP. 

ISMAP for Low-Impact Use (ISMAP-LIU) is a system for cloud services subject to ISMAP designed for SaaS services used in low-risk operations and information processing. 

Japanese government offices, ministries and agencies must in principle procure cloud services included on the ISMAP Cloud Service List or ISMAP-LIU Cloud Service List. However, in recent years, there has been increasing use of cloud services not just by government agencies but also by the private sector. We expect this to become increasingly commonplace and embedded in more companies going forward. These also underscore the growing importance of ISMAP registration for cloud service providers.

How EY can help

Being able to communicate information on the safety of cloud services through independent and objective third-party information security assessments is increasingly important due to the need to mitigate information security concerns among government agencies and companies about the introduction of these services.

EY can perform information security assessments, beginning at the preparatory stage for both ISMAP and ISMAP-LIU. We are experienced in performing information security assessments for all cloud service types, including SaaS, PaaS and IaaS, and can perform assessments which account for the characteristics of cloud services. We also aim to cater to the requirements of diverse cloud service providers, including information security assessments for providers offering multiple cloud services or located around the globe. We are also to incorporate streamlining with other information security audit, certification and assurance tasks.
 

ISMAP and ISMAP-LIU readiness assessment

Specific criteria must be satisfied as part of the ISMAP Information Security Assessment. As a consequence, even cloud service providers who have already undergone ISMS certification and SOC2 processes often experience considerable difficulty during their first information security assessment for ISMAP registration. Under ISMAP, providers must present an improvement plan for any issues identified during an assessment, for which advance preparation becomes a key requirement. EY conducts readiness assessments for both ISMAP and ISMAP-LIU while maintaining its independence: this allows providers to make adequate preparations for the ISMAP Information Security Assessment.
 

ISMAP and ISMAP-LIU Information Security Assessment

EY conducts ISMAP and ISMAP-LIU information security assessments of cloud service providers as an assessor registered on the ISMAP Assessor List from the start of ISMAP. As there is only a brief period from conclusion of the designated assessment period to the deadline for presentation of the assessment report, smooth execution is required. At EY, we leverage our extensive know-how from performing various information security audits to seek to enhance the efficiency of this process.
 

The Information system Security Management and Assessment Program (ISMAP) framework