If you sell equipment, software or maintenance services to a Japanese critical infrastructure operator, the government may screen your company, your shareholders and your subcontractors before the operator is allowed to buy from you. That screening comes from Chapter III of Japan's Economic Security Promotion Act, which since 17 May 2024 has required designated operators to file an introduction plan before installing a specified critical facility or outsourcing its critical maintenance. This guide explains who is designated, what goes into a plan, how the review works, the cyber security measures the plan must describe and what suppliers should prepare. It is written for security, compliance and bid teams at operators and at domestic and foreign suppliers. The operator-side incident reporting duties under the newer Active Cyber Defence law are covered separately in the Japan Active Cyber Defence Act Guide, and this page does not repeat them.
Key takeaways
- Prior screening, not after-the-fact reporting. Designated operators must submit an introduction plan before introducing a specified critical facility or entrusting its critical maintenance and management to a third party.
- A 30-day standstill applies. The standard screening period is 30 days, during which introduction or entrustment is prohibited; the minister can shorten it or extend it, with total extension capped at four months.
- Suppliers are disclosed in detail. Plans name the supplier, its country of incorporation, holders of 5 per cent or more of voting rights, officers, significant sales to foreign governments and the place of manufacture.
- Subcontractor chains are in scope. All subcontractors generally have to be listed, contractors need prior approval to subcontract, and subcontractors must meet the same level of cyber security measures.
- Scope is growing. As of 1 July 2026 the Cabinet Office reported 258 designated operators, and an amending act promulgated on 17 June 2026 adds medical care as a sector, to start within 18 months.
The Act and where Chapter III fits
The Economic Security Promotion Act is formally the Act on the Promotion of Ensuring National Security through Integrated Implementation of Economic Measures (Act No. 43 of 2022, promulgated 18 May 2022). It has several pillars, including supply of critical materials, critical technology development and non-disclosure of certain patent applications. Chapter III, the system for stable provision of specified essential infrastructure services, is the part that reaches into IT and OT procurement.
| Date | Milestone (Cabinet Office) |
|---|---|
| 18 May 2022 | Act promulgated |
| 1 November 2023 | Partial enforcement of the infrastructure provisions |
| 17 November 2023 | Transition period began, running to 16 May 2024 |
| 17 May 2024 | Obligation to notify introduction plans began |
| 17 June 2026 | Amending act promulgated adding medical care, to start by Cabinet Order within one year and six months |
| 1 July 2026 | 258 operators designated |
The Active Cyber Defence law builds on the operators designated under this Act; see the Japan Active Cyber Defence Act Guide for how the two regimes interact.
Who is designated
For each sector, the competent minister sets designation criteria by Ministerial Order and then designates and publishes "specified essential infrastructure service providers". The Cabinet Order details which businesses in each sector are covered.
| Group | Sectors listed by the Cabinet Office |
|---|---|
| Energy and utilities | Electricity, gas, petroleum, water supply |
| Transport and logistics | Railway, truck transportation, international maritime cargo, port and harbour transport, air transport, airports |
| Communications | Telecommunications, broadcasting, postal service |
| Finance | Financial services, credit cards |
| Health (not yet in force) | Medical care, added by the 2026 amending act |
Designation is by name, so a company is either on the published list or not. Suppliers should ask customers directly whether they are designated and which of the products or services being bought fall within a specified critical facility.
What triggers a filing
- Introducing a specified critical facility: facilities the state designates for use in the regulated services, broken down into component facilities. Typical examples are control and operations systems whose misuse could disrupt the service. The exact list per sector is in the ministerial ordinances.
- Entrusting critical maintenance and management: outsourcing maintenance or management work that the Act treats as critical. Other work, such as physical facility security, is distinguished as not critical.
- Urgent cases: where urgency criteria are met, the operator may introduce or entrust first but must file an urgent introduction notification without delay.
- Changes: material changes to a filed plan need advance notice, other changes are reported after the fact, and minor changes need neither.
What goes into an introduction plan
| Plan type | Content described by the Cabinet Office |
|---|---|
| Facility introduction plan | Facility type, name, functions and location; purpose, parties and date; supplier name, address, country of incorporation, holders of 5 per cent or more of voting rights, officers, sales to foreign governments of 25 per cent or more of annual sales, place of manufacture; component facility information; risk management measures with supporting documents |
| Entrustment plan | Facility details; purpose, scope, place and date or duration of the work; contractor details; subcontractor details |
| Supporting documents | Certificates of registered information (not needed for entities registered in Japan) and officers' identity documents such as passport copies |
For a foreign supplier, the practical burden is assembling corporate ownership, officer identity and manufacturing location data quickly and accurately, often in Japanese, so the operator can file. Keep a ready pack and update it when shareholders or officers change.
The cyber security measures a plan describes
The risk management section is where cyber security lives. The Cabinet Office outline lists measures including the following, applied in proportion to risk; operators need not adopt every measure listed.
| Measure | What a supplier should be ready to evidence |
|---|---|
| Malicious code and vulnerability testing before introduction | Test reports for the delivered build, software composition records and a vulnerability handling process |
| Security patching and anti-malware updates | Supported patch cadence, end-of-support dates and validated update procedures for OT components |
| Access controls | Named maintenance accounts, removal of default credentials, role separation |
| Unauthorised access monitoring and control for internet-connected facilities | Logging, remote access controls and monitoring interfaces the operator can use |
| Backups and recovery plans for ransomware | Configuration backup and restore procedures, recovery time estimates |
| Incident response procedures | Supplier contact points, escalation times, cooperation commitments |
| Cyber security training for workers, at least annually | Training records for staff doing the maintenance work |
See the NIST SP 800-82 OT Security Guide and the Hardware and Firmware SBOM Guide for evidence formats that map well to these measures.
How the review works
- Filing: the operator submits the plan to the competent minister.
- Screening: the standard period is 30 days, during which the operator must not introduce or entrust. The minister may shorten or extend it, up to four months of extension in total, and may consult and comment.
- Recommendation: if the facility is highly likely to be misused for disruptive actions, the state may recommend measures to prevent this before introduction or entrustment. The operator must say within 10 days whether it accepts, and may resubmit a revised plan.
- Order: the state may order such measures.
- Inspection: the state may carry out on-site inspections, and operators must cooperate with them.
Penalties are set in the Japanese text of the Act; this page does not state figures because they could not be confirmed from two sources. Confirm against the official text before relying on any summary.
Subcontractors and re-entrustment
- List the chain: generally every subcontractor in the chain is listed in the plan.
- Exemption route: most subcontractor information can be omitted if exemption conditions are met, such as identifying the scope and timing of the work and ensuring the subcontractor controls site access and audits work records, with supporting documents attached.
- Prior approval: contractors must get prior approval before subcontracting and provide information to check the subcontractor's cyber security.
- Same level of measures: subcontractors must meet the same level of cyber security measures as the contractor.
Global suppliers that route support through regional partners or follow-the-sun teams need to map who actually touches the facility, including remote support from outside Japan. See the ISO/IEC 27036 Supplier Relationships Guide.
Where identity fits
Maintenance entrustment is, in practice, a grant of privileged access. The same accounts and keys that let a supplier patch a control system could let an attacker disrupt it.
- Named, approved maintainers: tie each maintenance account to a named person at a listed contractor or subcontractor, so the access list matches the filed plan.
- Remote access through a controlled path: brokered, recorded sessions with multi-factor authentication, enabled for the maintenance window only. See the OT Remote Access Guide.
- Machine credentials in devices: embedded service accounts, update-signing keys and vendor cloud connectors are part of the facility's risk. Record them and how they are rotated. See Remote access and PAM vendors as tier-zero suppliers.
Decision guidance
- Is this purchase in scope? Only if the buyer is designated and the item is a specified critical facility or its critical maintenance. Ask the buyer to confirm in writing; do not assume a whole contract is in scope.
- Exempt subcontractor or full disclosure? Use the exemption route where the work is narrow and the subcontractor's access is supervised; disclose fully where the subcontractor has independent or remote access.
- Large versus small suppliers: large suppliers should build a standing disclosure pack per legal entity. Smaller suppliers can work through the prime contractor, but still need ownership and officer data available.
- Planning lead time: build at least the 30-day standstill, plus a buffer for possible extension, into delivery schedules. This is our suggestion, not a legal rule.
Measuring readiness
- Disclosure pack freshness: days since ownership, officer and manufacturing data was last verified.
- Subcontractor coverage: percentage of subcontractors with approval and cyber security evidence on file.
- Screening lead time: average days from plan filing to clearance on your customers' projects.
- Maintenance account alignment: number of maintenance accounts not traceable to a listed person (target zero).
- Training currency: share of maintenance staff trained in the last 12 months.
Common failure patterns
- Late disclosure data: ownership or officer documents arrive after the planned installation date, pushing the standstill past go-live.
- Invisible subcontractors: remote support delivered by an unlisted partner or offshore team.
- Treating changes as minor: a supplier swap or new remote maintenance route handled as routine when it is a material change needing advance notice.
- Generic security statements: marketing documents offered where the plan needs test results, patch processes and incident contacts.
- Shared vendor accounts: one maintenance login used by several technicians, which cannot be matched to the filed plan.
Framework mapping
| Chapter III element | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Supplier disclosure and screening | GV.SC-06 | SR-6 |
| Supply chain risk management programme | GV.SC-01 | SR-3 |
| Security requirements in contracts and subcontracting | GV.SC-05 | SA-9 |
| Pre-introduction malicious code and vulnerability testing | GV.SC-07 | SA-11, SR-5 |
| Maintenance access control | PR.AA-05 | MA-4 |
| Ransomware backups and recovery | PR.DS-11 | CP-9 |
| Incident response procedures | RS.MA-01 | IR-8 |
The mapping is ours, for orientation.
Practitioner checklist
- Confirm whether each Japanese customer is a designated operator and which items are specified critical facilities.
- Maintain a disclosure pack: country of incorporation, 5 per cent shareholders, officers, foreign government sales and manufacturing locations.
- Map every subcontractor that touches the facility, including remote and offshore support.
- Seek prior approval before subcontracting and pass cyber security requirements down.
- Prepare pre-delivery malicious code and vulnerability test evidence for each build.
- Document patching, anti-malware updates, backup and recovery, and incident contacts.
- Issue named, time-limited maintenance accounts and record remote access sessions.
- Build the 30-day standstill and possible extension into project plans.
- Treat supplier or remote-access changes as potentially material and check before acting.
Standards and references
- Cabinet Office of Japan: Outline of the system for ensuring stable provision of specified essential infrastructure services (English)
- NHI Mgmt Group: Japan Active Cyber Defence Act Guide
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Japan Active Cyber Defence Act Guide · Japan FSA Cyber Security Guidelines · NIST SP 800-161 Cyber Supply Chain Risk Management Guide · Supplier Security Policy Template. This guide summarises Chapter III of Japan's Economic Security Promotion Act and is not legal advice. Confirm against the official text before relying on it.