[Home](/)/[Resources](/resources)/Japan IoT Cybersecurity

JapanCybersecurity / IoT

# Japan IoT Security: Cybersecurity Requirements for Connected Products

Japan's IoT security landscape is moving fast. The METI IoT Security Safety Framework, MIC's 2023 guidelines, and Telecommunications Business Act obligations already set clear expectations — and METI is building mandatory certification requirements aligned with the EU Cyber Resilience Act. This guide covers what connected product manufacturers need to implement now, and how to stay ahead of the mandatory requirements coming for 2025 and beyond.

Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fjapan-cybersecurity-iot-connected-products)

At a glance

Primary framework

METI IoT-SSF (2019, updated 2022)

MIC guidelines

IoT Security Guidelines (2023)

Certification status

Guidance now; mandatory from 2025+

Vulnerability disclosure

JPCERT/CC (45-day window)

Enforcement risk

NICT NOTICE program scans

## Key regulatory frameworks and requirements

### METI IoT Security Safety Framework (IoT-SSF)

METI published the IoT Security Safety Framework in 2019, with a significant update in 2022 that aligned it more closely with NIST CSF and ETSI EN 303 645. The framework organizes security requirements across five functions — Identify, Protect, Detect, Respond, Recover — and provides product-category-specific guidance for consumer IoT, industrial IoT, and connected vehicles. Crucially, IoT-SSF is currently guidance rather than a mandatory certification standard, meaning manufacturers self-assess and self-declare conformance. However, METI has signalled that mandatory requirements modelled on the EU Cyber Resilience Act (CRA) are under development, with a target introduction timeframe of 2025 onward. Companies that implement IoT-SSF now are best positioned for the transition to mandatory requirements.

### MIC IoT Security Guidelines (2023)

The Ministry of Internal Affairs and Communications published updated IoT device security guidelines in 2023, focusing specifically on connected devices that access telecommunications networks. The MIC guidelines address the full device lifecycle: secure design, manufacturing, deployment, operation, and end-of-life. Key technical requirements include prohibition of universal default credentials, encrypted communications for all data in transit, and a mechanism for receiving security updates throughout the device's supported life. MIC coordinates with the National Police Agency (NPA) and NISC on guidelines for devices used in critical communications infrastructure. Products failing to meet MIC guidelines face increasing informal pressure from major Japanese mobile network operators, who are beginning to require security attestations from device vendors as a condition of network certification.

### Telecommunications Business Act (電気通信事業法) Cybersecurity Obligations

The Telecommunications Business Act imposes cybersecurity obligations on businesses that provide telecommunications services and, increasingly, on the connected devices used on those networks. The 2022 amendments strengthened requirements for network operators to assess the security posture of equipment on their networks — which in practice creates downstream pressure on device manufacturers to demonstrate compliance. For IoT device manufacturers, the relevant obligation is that devices must not create security vulnerabilities that could compromise the integrity of the telecommunications network. Devices in categories identified by MIC as high-risk (routers, IP cameras, industrial gateways) are subject to heightened scrutiny and may be flagged through the NICT-operated NOTICE project, which actively scans for IoT devices with default credentials exposed on the internet.

### Default Password Prohibition and Unique Credential Requirements

Both MIC guidelines and METI IoT-SSF explicitly prohibit the use of universal default passwords — a requirement that mirrors ETSI EN 303 645 Provision 5.1. Each device must ship with a unique per-device password or require the user to set a password during first-time setup before the device becomes operational. Hardcoded credentials that cannot be changed by the user are prohibited regardless of complexity. For devices with web-based management interfaces, session timeout, brute-force lockout, and multi-factor authentication support are recommended best practices in METI guidance. Japan's NICT runs the NOTICE (National Operation Towards IoT Clean Environment) program, which scans internet-connected devices for default credential exposure and notifies ISPs to alert affected device owners — manufacturers whose devices appear in NOTICE scans face reputational and regulatory risk.

### Firmware Update and Patch Management Requirements

METI IoT-SSF and MIC guidelines both require that consumer IoT devices support security updates throughout their supported product life. Specifically, devices must have a secure, authenticated firmware update mechanism — updates must be delivered over encrypted channels and verified with a digital signature before installation. Automatic update capability is recommended for consumer devices; at minimum, users must be notified of available security updates through an in-device mechanism or companion app. Manufacturers must define and publish a minimum support period — the period during which security patches will be issued — before product launch. For products targeting Japanese critical infrastructure sectors, NISC cybersecurity policy requires defined patch response timelines: critical vulnerabilities must be remediated within 30 days of patch availability.

### JPCERT/CC Vulnerability Disclosure and Coordination

JPCERT/CC (Japan Computer Emergency Response Team Coordination Center) is Japan's national CERT and handles coordinated vulnerability disclosure for products sold in the Japanese market. METI and MIC guidelines both recommend that manufacturers register a vulnerability disclosure point of contact (POC) with JPCERT/CC, enabling coordinated disclosure when researchers identify security flaws. JPCERT/CC follows a 45-day coordinated disclosure timeline — manufacturers are notified of a reported vulnerability and given 45 days to issue a patch before JPCERT/CC publishes an advisory. Failure to respond within the disclosure window results in publication regardless. Manufacturers should also register with the IPA (Information-technology Promotion Agency) vulnerability database (JVN — Japan Vulnerability Notes) to receive CVE-equivalent identifiers for disclosed vulnerabilities in their products.

## Compliance process: step by step

01

Review the METI IoT Security Safety Framework (IoT-SSF) against your device's architecture. Map your device's connectivity interfaces, data flows, authentication mechanisms, and update processes against the IoT-SSF's five functions (Identify, Protect, Detect, Respond, Recover). Document gaps as the basis for your security design remediation plan — this self-assessment forms your compliance evidence trail when mandatory requirements arrive.

02

Eliminate default passwords and implement per-device unique credentials. Audit your device's factory provisioning process to confirm that no two devices ship with the same password. If your current manufacturing process uses a shared default, redesign provisioning to generate or inject unique credentials per device at the factory stage. Add a mandatory password-change step to the first-boot setup flow if unique provisioning is not feasible.

03

Implement TLS 1.2 or higher for all device communications. Audit every network interface and API call your device makes — cloud sync, remote management, firmware update downloads, telemetry — and confirm TLS 1.2+ with valid certificate chain verification is enforced. Disable TLS 1.0/1.1 and SSLv3. For device-to-device local communications, evaluate DTLS or equivalent for UDP-based protocols. Document cipher suites and key lengths in your security specification.

04

Build a firmware update mechanism with cryptographic integrity verification. Implement signed firmware packages: the update payload must be signed with a private key held securely by you, and the device must verify the signature against a stored public key before applying any update. Deliver updates over HTTPS. Define your minimum support period and document it in the product specification and on your Japanese product page.

05

Register a vulnerability disclosure policy and point of contact with JPCERT/CC. Submit your organization's security contact information and disclosure policy to JPCERT/CC's vendor registry. Your policy should specify response timelines that align with JPCERT/CC's 45-day coordinated disclosure window. Also register with IPA's JVN (Japan Vulnerability Notes) system to receive CVE-equivalent identifiers and participate in Japan's coordinated vulnerability notification ecosystem.

06

Map devices deployed in critical infrastructure sectors against NISC requirements. If your IoT product is sold into energy, water, transportation, finance, or communications sectors in Japan, assess whether NISC's Basic Cybersecurity Policy sector-specific requirements apply. NISC publishes sector cybersecurity guidelines that may impose mandatory incident reporting timelines and minimum security control requirements beyond general IoT-SSF guidance.

07

Prepare for upcoming mandatory certification aligned with the EU Cyber Resilience Act. Monitor METI's ongoing regulatory consultation on mandatory IoT security requirements. Based on public statements as of 2024, METI is developing a conformity assessment scheme that will require third-party testing for high-risk IoT categories. Begin engaging with accredited Japanese testing laboratories (VLAC, JQA) now to understand the testing scope and lead times for when mandatory requirements land.

## Frequently asked questions

### Is there a mandatory IoT security certification in Japan?

As of 2024, Japan does not yet have a mandatory pre-market IoT security certification scheme. The METI IoT Security Safety Framework (IoT-SSF) and MIC IoT security guidelines are currently guidance documents, and compliance is self-declared. However, METI has publicly indicated that mandatory requirements — modelled on the EU Cyber Resilience Act — are in development, with an expected introduction timeline starting from 2025 onward for higher-risk product categories. Companies selling into Japan's critical infrastructure sectors face additional NISC requirements that are more prescriptive. The safe approach is to implement IoT-SSF now and document your conformance evidence, treating it as preparation for mandatory requirements.

### What is the METI IoT Security Safety Framework?

The METI IoT Security Safety Framework (IoT-SSF) is Japan's primary guidance document for IoT product security, first published in 2019 and updated in 2022. It provides a risk-based approach to IoT security organized around the five NIST CSF functions — Identify, Protect, Detect, Respond, Recover — with product-category-specific annexes covering consumer IoT, industrial IoT, and connected vehicles. The framework explicitly references and aligns with international standards including NIST CSF, ETSI EN 303 645, and IEC 62443. Manufacturers are expected to perform a self-assessment against the framework and document their security design decisions. METI uses IoT-SSF conformance as a baseline when evaluating whether devices meet the security expectations of the Telecommunications Business Act.

### Are default passwords prohibited on IoT devices in Japan?

Yes. Both METI IoT-SSF and MIC's 2023 IoT security guidelines explicitly prohibit universal default passwords on connected devices — a position consistent with ETSI EN 303 645 and the UK Product Security and Telecommunications Infrastructure (PSTI) Act. Each device must ship with a unique per-device credential or require users to set a password before the device becomes operational. Japan's NICT actively enforces this through the NOTICE program, which scans internet-connected devices for exposed default credentials and notifies ISPs to alert affected device owners. Manufacturers whose devices consistently appear in NOTICE scans face reputational damage and informal regulatory pressure from MIC.

### How should manufacturers handle cybersecurity vulnerability disclosures in Japan?

Manufacturers should register a vulnerability disclosure point of contact with JPCERT/CC and with IPA's JVN (Japan Vulnerability Notes) database. JPCERT/CC operates a coordinated vulnerability disclosure process with a standard 45-day response window — when a security researcher reports a vulnerability in your product, JPCERT/CC notifies you and gives you 45 days to develop and issue a patch before publishing an advisory. Failure to respond within the window results in public disclosure regardless of patch status. Manufacturers should also publish a clear Vulnerability Disclosure Policy (VDP) accessible from their Japanese product support pages, specifying how researchers can report issues and what response timelines to expect.

**Disclaimer:** Educational resource only. Regulatory requirements change. Consult a qualified compliance specialist before making decisions.

🇯🇵 Japan roadmap for your product

Every standard, document, and test that applies — free, no account required.

See your free roadmap

Learn this properly

In-depth course that teaches the full process, not just this one answer.

[Start the course — $149](/courses/48-japan-telec-mic-certification-wireless-iot-devices)[Prefer to read? Get the book — $24.99](/books/48-japan-telec-mic-certification-wireless-iot-devices)

Related guides

*   [Japan METI IoT Security GuidelinesJapan METI's IoT security guidelines for connected hardware makers: baseline security requirements, the labeling scheme for IoT security conformance, and how this relates to Japan's broader APPI data protection obligations.](/guides/japan-iot-security-guidelines)
*   [Japan APPI Connected ProductsJapan's APPI (Act on Protection of Personal Information) obligations for IoT and connected hardware makers: consent requirements for data collection, cross-border transfer restrictions, and 2022 amendment penalties.](/guides/japan-appi-connected-products)
*   [US IoT Cybersecurity ActGuide to the IoT Cybersecurity Improvement Act of 2020 — NIST SP 800-213A baseline, federal procurement requirements, and the F…](/guides/us-iot-cybersecurity-act)
*   [EU Cyber Resilience Act (CRA)EU Cyber Resilience Act for hardware: default-secure requirements, vulnerability disclosure, 24-hour incident notification, and the four Annex I product classes.](/guides/eu-cyber-resilience-act)
*   [UK PSTI ActUK PSTI Act 2022: mandatory security requirements for consumer connectable products, statement of compliance, and OPSS enforcement from April 2024.](/guides/uk-psti-act-connected-products)