Wiz not yet listed on Japan's ISMAP cloud registry; external assessment audit targeted for early 2027
Wiz states that it is not yet listed on the ISMAP Cloud Service List, which Japanese government agencies are generally required to procure from. The company says it has completed an internal gap assessment against the current ISMAP Control Measures and the published draft revisions. It has engaged an audit firm registered on the ISMAP Auditors List and plans to formally start the external assessment in early 2027. The post stresses that ISMAP has no provisional or "in progress" status, so a company is either on the registry or not. Wiz also notes that holding ISO/IEC 27001, SOC 2, PCI DSS or FedRAMP does not by itself equal ISMAP registration, and that using Wiz does not by itself make a customer ISMAP-compliant.
Detalhes técnicos
The article describes ISMAP as a pre-vetted catalogue built on the Common Standards for government cybersecurity, JIS Q 27001 and JIS Q 27017, with ISO/IEC 27018 and selected NIST SP 800-53 controls added to cover gaps. Registration requires external audits by firms on the ISMAP Auditors List, Japanese-language application documents and audit trails, and recurring renewals and audits after listing. Proposed revisions to the control measures aim to align with newer international standards and reduce the number of controls, and the article says the draft and its schedule may change.
Remediação
This is a vendor compliance roadmap, not a vulnerability report, so no patch or mitigation applies. Japanese public sector buyers that need ISMAP-listed services should check the official registry and not rely on Wiz's certifications or its planned audit date. Wiz offers Japanese public sector customers a walkthrough of its security posture, its ISO and SOC 2 reports, and a mapping of its controls to ISMAP.
Linha do tempo
-
Wiz not yet listed on Japan's ISMAP cloud registry; external assessment audit targeted for early 2027
ler a análise desta fonte ocultar
Wiz states that it is not yet listed on the ISMAP Cloud Service List, which Japanese government agencies are generally required to procure from. The company says it has completed an internal gap assessment against the current ISMAP Control Measures and the published draft revisions. It has engaged an audit firm registered on the ISMAP Auditors List and plans to formally start the external assessment in early 2027. The post stresses that ISMAP has no provisional or "in progress" status, so a company is either on the registry or not. Wiz also notes that holding ISO/IEC 27001, SOC 2, PCI DSS or FedRAMP does not by itself equal ISMAP registration, and that using Wiz does not by itself make a customer ISMAP-compliant.
Technical Details
The article describes ISMAP as a pre-vetted catalogue built on the Common Standards for government cybersecurity, JIS Q 27001 and JIS Q 27017, with ISO/IEC 27018 and selected NIST SP 800-53 controls added to cover gaps. Registration requires external audits by firms on the ISMAP Auditors List, Japanese-language application documents and audit trails, and recurring renewals and audits after listing. Proposed revisions to the control measures aim to align with newer international standards and reduce the number of controls, and the article says the draft and its schedule may change.
Remediation
This is a vendor compliance roadmap, not a vulnerability report, so no patch or mitigation applies. Japanese public sector buyers that need ISMAP-listed services should check the official registry and not rely on Wiz's certifications or its planned audit date. Wiz offers Japanese public sector customers a walkthrough of its security posture, its ISO and SOC 2 reports, and a mapping of its controls to ISMAP.