Cloudflare is now ISMAP registered in Japan

By Erik Engstrom and Yutaka Shimowada

We are thrilled to announce that Cloudflare has been officially registered under the Information System Security Management and Assessment Program (ISMAP).

ISMAP is the standard for government security procurement in Japan, administered by the National Cybersecurity Office (NCO), Digital Agency, Ministry of Internal Affairs and Communications (MIC),and Ministry of Economy Trade and Industry (METI). Achieving this registration validates and reaffirms our commitment to providing secure, resilient, and high-performance solutions to government agencies and other highly regulated critical infrastructure industries across Japan. 

Previously, through our Cloudflare for Government program, we have obtained FedRAMP Moderate authorization, assessed at the IRAP PROTECTED level, and obtained ENS certification. For more, check out our Trust Hub.

Complying with the Control Criteria of ISMAP

The ISMAP is based on ISO/IEC 27001, 27002, and 27017, adding necessary perspectives from The Common Standards for Information Security Measures for Government Agencies and Related Agencies, and NIST SP800-53. There are approximately 1,200 management controls, and we must decide whether to adopt them and design and implement individual internal controls.

Cloudflare has obtained FedRAMP, ISO27001, SOC2, and other certifications, so complying with the Control Criteria of ISMAP was not so difficult.

However, meeting the quality and quantity of operational audit trails required by auditors is not easy. Furthermore, we had to undergo a detailed technical examination by the ISMAP Operations Support Organization. Including preparation time, it took approximately two years to complete ISMAP registration.

Because these audits and examinations are conducted annually, our team is currently working on automating the collection of operational audit trails.

For public institutions procuring cloud services, only services that have passed rigorous audits and reviews are included in the ISMAP cloud service list, so you can choose our cloud services with peace of mind, without lowering the level of the Common Standards that public institutions must meet.

There are 2 key features that address particularly important requirements.

Technical sovereignty: data localization & regional services 

We understand that for the Japanese public sector, data sovereignty is non-negotiable. This is why our ISMAP Cloudflare for Government offering leverages Cloudflare’s Data Localization Suite to give agencies precise control over where their data travels.

• Regional services: Regional Services allows customers to define where their traffic is decrypted and processed –- in this case only in Japanese colocations. You get the DDoS protection of a global network, but the inspection boundary never leaves Japan.
• Key management: Geo Key Manager allows customers to choose where to store their private SSL/TLS keys — in this case exclusively in Japan, ensuring that no one — not even Cloudflare — can decrypt traffic outside your jurisdiction.

Securing Japan’s digital infrastructure 

Japan’s digital landscape is evolving rapidly, as are the threats it faces. The Information-technology Promotion Agency (IPA), which is also an ISMAP Operations Support Organization, recently highlighted the growing sophistication of ransomware, supply chain vulnerabilities, and targeted attacks against public institutions in their annual threat assessment. Also, the number and scale of DDoS attacks have been increasing in these years, making it an urgent priority to establish infrastructure capable of mitigating them.

For Japanese government agencies, the challenge is twofold: they must defend against these escalating threats while simultaneously modernizing their digital services for citizens. With ISMAP registration, Cloudflare is now uniquely positioned to solve this paradox. Agencies can now leverage our massive global network to stop attacks before they reach Japan, all while adhering to the strict government security baselines required for public procurement.

Global scale, local control 

Our approach to government service is different relative to our competitors. Instead of building a siloed "government-only" cloud that often suffers from poor performance and feature lag, we built compliance capabilities directly into our global network.

Cloudflare’s network spans more than 330 cities globally, including robust presences in Tokyo and Osaka. This density allows us to be within milliseconds of nearly every Internet user in Japan. By running the same security software across our entire network, we have successfully mitigated the three largest DDoS attacks to date, including one in which the volume reached 22.2 TB/s on September 23, 2025. This is the scale we are bringing to our Japanese public sector customers.

A single platform for modern government 

Our single-platform strategy means that ISMAP registration covers a broad scope of our services. This includes our core application security products like our CDN, WAF, and DDoS protection, which defend against volumetric attacks.

Crucially, it also covers our Zero Trust platform — including Secure Web Gateway and Remote Browser Isolation. These tools allow government employees to work securely from anywhere, neutralizing threats like phishing and credential theft which are currently top-of-mind for Japanese CISOs. Cloudflare Workers is also approved, enabling agencies to build fast, compliant, serverless applications without managing infrastructure.

Partnering for the future 

Obtaining ISMAP registration is a milestone in our mission to help build a better Internet for Japan. We invite all Japanese government agencies, local authorities, and partners to explore how Cloudflare for Government can modernize your security posture.

Please reach out to us at japan@cloudflare.com or contact our Tokyo team directly to learn more.