Japan’s IPA Sets Out How Evaluation Bodies Get Approved Under JC-STAR

IPA Formalizes How Evaluation Bodies Get Approved Under JC-STAR

On July 15, 2026, Japan’s Information-technology Promotion Agency (IPA) issued JSM-01-B, the “Security Requirement Conformity Assessment Body Approval Business Handling Procedures,” effective the same day. The document sets out, in procedural detail, how IPA approves the evaluation bodies (labs) and individual evaluators (testers) who carry out conformity assessments under the scheme.

For anyone tracking IoT security certification bodies and test labs across the region, JSM-01-B is a useful reference: it lays out the concrete steps, documentation, and fees involved in becoming an approved JC-STAR evaluation body or evaluator.

Two JC-Star Approval Tracks

JSM-01-B covers two approvals at once. First, the lab itself (the “evaluation body”) has to be approved as an organization. Second, the individual staff who will do the actual testing (the “evaluators”) have to be qualified separately. IPA requires both applications to come in together. In other words, a lab can’t get approved without also putting forward its testers for qualification at the same time.

Step-by-Step: How Approval Actually Works

Steps for lab (evaluation body) approval:

1. Lab holds a required pre-consultation meeting with IPA, then applies
2. IPA checks that the application papers are complete
3. Both sides sign a confidentiality agreement
4. IPA refers the application to METI’s Cybersecurity Division for clearance
5. Lab pays the application fee
6. IPA reviews documents (quality manual, training records, facility and equipment information)
7. IPA visits the lab in person (on-site audit) to check everything
8. If it passes, IPA approves the lab and posts its name, registration number, and approved conformity level publicly on IPA’s website

Steps for tester (evaluator) approval:

1. Similar process: apply → confirm documents are complete → pay fee → document review
2. Some testers must also complete a supervised practice (trial) evaluation
3. Written exam
4. Interview with a panel of at least three reviewers
5. If passed, IPA issues the evaluator a registration number and an electronically signed qualification certificate

Application Fees

All fees below are one-time and non-refundable, except the yearly tester renewal fee.

Approval isn’t a one-time event. Evaluator qualifications are reviewed annually, as a matter of course every April. IPA can also suspend or revoke an evaluation body’s approval if it fails to correct deficiencies within a 30-day improvement window, with a formal advisory committee review required before any outright revocation. Changes in scope, ownership, or business succession each trigger their own notification and review procedures, and a revoked body’s listing stays visible on IPA’s site — marked as revoked — for six months before removal.

Key Takeaways

• JSM-01-B gives outside observers clear visibility into how IPA vets the evaluation bodies underpinning JC-STAR — useful context for any lab weighing whether to pursue JC-STAR recognition alongside existing IECEE, JISEC, or regional IoT certification portfolios.
• The mandatory METI Cybersecurity Division referral before an application is even accepted means JC-STAR evaluation body approval involves a policy-level check in addition to the technical review — worth flagging to clients treating this as a routine accreditation.
• Evaluator qualification is treated as seriously as body-level approval, with exams and interviews layered on top of document review; firms scoping out JC-STAR readiness should budget time for staff-level qualification, not just organizational accreditation.
• The published fee schedule and the six-month “revoked but listed” window are both practical details worth keeping on hand when advising clients on JC-STAR program costs and timelines.

News Source: https://www.ipa.go.jp/security/jc-star/kitei.html