Japanese government buyers, critical infrastructure operators and consumers now have a national label that tells them whether a connected product meets a defined security baseline, and manufacturers who ignore it risk being left out of procurement. JC-STAR, the Labeling Scheme based on Japan Cyber-Security Technical Assessment Requirements, is run by the Information-technology Promotion Agency, Japan (IPA) under policy set by the Ministry of Economy, Trade and Industry (METI). It opened for STAR-1 applications on 25 March 2025 and is linked by mutual recognition to the UK PSTI regime and Singapore's Cybersecurity Labelling Scheme. This guide explains the four levels, who self-declares and who needs a third-party evaluation, the 16 STAR-1 requirements, fees, validity, the procurement plans and the mutual recognition routes. It is for product security teams, compliance leads selling into Japan, and buyers who want to use the label in their own purchasing. Status and dates are as published by IPA and METI and checked on 8 November 2026.
Key takeaways
- Voluntary, but tied to procurement: METI describes JC-STAR as a voluntary scheme, and its plan is to write STAR-1 or above into Japanese government device procurement criteria, with local government and critical infrastructure use to follow.
- Four levels, two assessment models: STAR-1 and STAR-2 rest on vendor self-declaration with a checklist; STAR-3 and STAR-4 need independent third-party evaluation and IPA certification.
- STAR-1 is the only level open today: as of November 2026 IPA lists STAR-2 as under preparation and has published tentative STAR-3 requirements for network devices and network cameras only.
- The baseline is familiar: STAR-1's 16 requirements are harmonised with ETSI EN 303 645 and NISTIR 8425, covering unique default passwords, vulnerability disclosure, signed updates, secure storage and communication, and a published support period.
- One assessment can serve three markets: PSTI-compliant products and Singapore CLS Level 1 products get checklist exemptions and a reduced STAR-1 fee, and JC-STAR labelled products can apply for PSTI and CLS recognition in return.
Scope: who and what is covered
JC-STAR applies to IoT products that send and receive data over the Internet Protocol, including products that reach the internet only through another device such as a hub or gateway. According to the STAR-1 Conformance Requirements and Assessment Methods (JST-CR-01-01-2024R1), a "product" can be a single device or a device together with its associated services, such as the cloud back end and companion app. METI's launch announcement covers both consumer and industrial products and excludes general-purpose IT equipment: PCs, tablets and smartphones are out of scope.
The STAR-1 document also states what the baseline does not try to address: whole systems, attacks requiring physical access during operation, supply chain tampering and denial of service. That is an important limit for buyers. A STAR-1 label is evidence of baseline product hygiene, not proof that a product is fit for a high-assurance deployment, and IPA's scheme page says plainly that the label does not assure complete security.
| Level | What it covers | Assessment | Intended buyers | Status (Nov 2026) |
|---|---|---|---|---|
| STAR-1 | Common baseline for all in-scope IoT products | Vendor self-declaration, IPA grants label on a checklist | All buyers, consumers included | Open since 25 March 2025 |
| STAR-2 | STAR-1 plus basic requirements per product category | Vendor self-declaration, IPA grants label on a checklist | Buyers wanting category-specific assurance | Under preparation; IPA says applications are planned for 2026 or later |
| STAR-3 | Additional requirements per category for critical systems | Independent third-party evaluation; IPA certifies on the evaluation reports | Government, critical infrastructure, local governments, large companies | Tentative v1.0 requirements for network devices and network cameras (2026) |
| STAR-4 | Highest per-category requirements for critical systems | Independent third-party evaluation; IPA certifies | As STAR-3 | No category requirements published |
Approved products carry a conformance label with a two-dimensional code. IPA says the code leads to product details, evaluation information, security information and contact details on an IPA-managed page, so a buyer can check a label against the register rather than trusting the packaging. IPA publishes a list of labelled products on its JC-STAR site.
Key obligations
STAR-1 sets 16 requirements, numbered S1.1-01 to S1.1-16, grouped into nine security functions. The table below summarises them from the IPA document; read the full text and the STAR-1 Assessment Checklist before you self-declare, because each requirement has an assessment method and the checklist is what IPA reviews.
| Function | Requirement IDs | What a manufacturer must show (summary) | Closest ETSI EN 303 645 provision |
|---|---|---|---|
| Authentication and access control | S1.1-01 to S1.1-04 | Authenticated access to protected assets over IP; default passwords unique per device and strong, or changed at first start; authentication values changeable; brute-force resistance on non-constrained devices | 5.1 No universal default passwords |
| Vulnerability management | S1.1-05 | Public vulnerability disclosure policy with contact point, handling procedure and timelines for acknowledgement and status updates | 5.2 Means to manage reports of vulnerabilities |
| Software updates | S1.1-06 to S1.1-09 | Updatable software that shows its version and keeps it after power loss; simple update procedure; integrity checked before network updates are applied; documented policy prioritising security updates | 5.3 Keep software updated |
| Product identification | S1.1-10 | Model number visible on the product or through its interface or app | 5.3 (model designation) |
| Secure storage and communication | S1.1-11, S1.1-12 | Protected information stored securely, including on removable media; protected information protected from eavesdropping in transit, by the device or a protected environment such as a VPN | 5.4 and 5.5 |
| Attack surface reduction | S1.1-13 | Unneeded TCP/UDP ports, Bluetooth and USB interfaces disabled; vulnerability scan finds no exploitable issues | 5.6 Minimise exposed attack surfaces |
| Resilience | S1.1-14 | Credentials, settings and updates survive power or network loss without reverting to factory state | 5.9 Make systems resilient to outages |
| Data deletion | S1.1-15 | Users can delete their data on the device or associated services without rolling back security-relevant firmware | 5.11 Make it easy for users to delete user data |
| Information provision | S1.1-16 | User information on secure set-up and use, why updates matter, a defined support period and end-of-support policy, and safe disposal with data erasure | 5.3 and 6 (data protection information) |
The ETSI column is our mapping to help teams that already hold ETSI EN 303 645 evidence; IPA states that the requirements are harmonised with ETSI EN 303 645 and NISTIR 8425 but publishes its own conformance text, which is the one that counts. For the ETSI baseline in depth, see the ETSI EN 303 645 Consumer IoT Guide.
What self-declaration really means
The STAR-1 document is explicit that IPA does not verify conformance when it issues a STAR-1 label: the assurance rests on the vendor's own assessment. In exchange, IPA can inspect and carry out surveillance where conformance is in doubt and can revoke a label. Treat the checklist as a signed statement. Keep the test evidence, scan reports, update-signing design and disclosure policy that support each answer, because those are what you will be asked for if IPA or a large customer questions the claim.
Timeline and current status
| Date | Event | Source |
|---|---|---|
| November 2022 | METI study group on an IoT product security conformity assessment scheme begins work | METI |
| August 2024 | Study group final report; METI IoT Product Security Conformity Assessment Scheme Policy follows (the METI policy document is dated September 2024) | METI, IPA |
| 30 September 2024 | IPA publishes the JC-STAR scheme page and STAR-1 requirements, first edition | IPA |
| 5 December 2024 | STAR-1 requirements revised (JST-CR-01-01-2024R1) | IPA |
| 25 March 2025 | METI and IPA launch the scheme; STAR-1 applications open | METI, IPA |
| 1 January 2026 | Mutual recognition with UK PSTI compliance takes effect, per the IPA PSTI page (released 27 January 2026) | IPA |
| 1 June 2026 | Mutual recognition with Singapore CLS begins | IPA |
| July and September 2026 | Tentative STAR-3 security and conformance requirements for network devices and network cameras published | IPA |
Dates move. At launch METI said STAR-2 and above for network cameras and network devices such as routers were planned after January 2026, with smart home devices to follow; as of November 2026 the STAR-2 assessment page still reads "under preparation" and STAR-3 evaluation guides are not yet published. Check the IPA JC-STAR page before planning a submission around a higher level.
Fees and validity
- STAR-1 fee: METI's launch notice gives a regular fee of 198,000 JPY including tax, with an introductory 110,000 JPY for applications received by 30 September 2025. IPA's mutual recognition pages give 140,000 JPY for PSTI or CLS-based STAR-1 applications.
- Validity: STAR-1 labels are valid for up to two years. IPA's mutual recognition pages state that STAR-1 and STAR-2 labels extend in two-year increments, while STAR-3 and STAR-4 extend yearly with recertification five years after first certification.
- Applying: since 22 April 2026 applicants first obtain an application number through a request form (Japanese only), then submit the application form, the STAR-1 checklist and, for proxy applicants, an authorisation letter.
Enforcement and penalties
JC-STAR is not a law and carries no fines of its own. METI's September 2024 policy says vendors are not required to display the label. The levers are commercial and administrative:
- Label revocation: for STAR-1 and STAR-2, IPA can inspect, carry out surveillance and revoke the label where conformance is in doubt.
- Procurement exclusion: METI's launch notice says the government agency cybersecurity standards guidelines (FY2023 edition, partly revised July 2024) plan to include STAR-1 or above in device procurement criteria by the end of FY2025, subject to scheme development, with higher levels to follow. Confirm the current edition of those guidelines before relying on a specific date.
- Foreign law through mutual recognition: a JC-STAR label used to show UK PSTI compliance brings PSTI obligations with it. IPA notes that the UK Office for Product Safety and Standards (OPSS) carries out market surveillance and can act on non-compliant products, and that Northern Ireland is excluded from the recognition arrangement. See the UK PSTI Act Guide.
Mutual recognition
| Scheme | Into JC-STAR | Out of JC-STAR | Conditions noted by IPA |
|---|---|---|---|
| UK PSTI (security requirements regime) | PSTI-compliant products are treated as meeting S1.1-02, S1.1-05 and S1.1-16; submit the Statement of Compliance; STAR-1 fee 140,000 JPY | JC-STAR labelled products can apply for PSTI compliance listing; administrative fee 5,500 JPY; English product, vulnerability and contact information required | Only STAR-1 is recognised; Northern Ireland excluded; support period cannot be shortened once published |
| Singapore CLS(IoT) | CLS-labelled products are recognised as partly meeting STAR-1, so matching checklist items can be exempted; STAR-1 fee 140,000 JPY | JC-STAR labelled products apply for CLS (MRA) through Singapore's GoBusiness portal with no lab testing; CSA fee S$51 | Based on a METI and CSA memorandum of cooperation; STAR-1 maps to CLS Level 1 |
METI said at launch that it would continue to negotiate recognition with the US Cyber Trust Mark and the EU Cyber Resilience Act. As of November 2026 IPA's scheme page lists only the UK and Singapore arrangements. For the other schemes, see the Singapore Cybersecurity Labelling Scheme Guide, the US Cyber Trust Mark Guide and the Product Security Laws Map.
What it means for AI agents and non-human identities
Every connected product is a non-human identity: it authenticates to a cloud service, holds secrets and accepts code from its manufacturer. Several STAR-1 requirements are, in practice, machine identity controls.
- Per-device credentials: S1.1-02 rules out shared factory passwords. Extend the same thinking to device-to-cloud credentials: provision a unique key or certificate per device at manufacture rather than a fleet-wide API key embedded in firmware. See the Device and IoT Identity Guide and the IoT Device Identity with TPM and DICE Guide.
- Update signing keys: S1.1-08 requires integrity checks before network updates. The private key that signs firmware is one of the most valuable secrets a manufacturer holds; keep it in an HSM, restrict who and what can invoke signing, and log every signature. See the IoT Secure Firmware Update Guide.
- Associated services are in scope: because a product can include its cloud service and app, the service accounts, API tokens and admin consoles behind the device back end are part of what you are declaring. Inventory them and apply rotation and least privilege.
- Agents acting on devices: where AI agents or automation call device APIs (smart building platforms, fleet management), they should use scoped, short-lived credentials and their actions should be logged, so S1.1-01's authenticated access does not collapse into one over-privileged integration token.
Compliance steps
- Confirm scope: check the product communicates over IP, directly or through a gateway, and is not a PC, tablet or smartphone. Decide what "product" includes: device only, or device plus cloud service and app.
- Gap-assess against S1.1-01 to S1.1-16: download the STAR-1 requirements, Assessment Guide, supplementary guidance and checklist from IPA. If you hold ETSI EN 303 645, PSTI or CLS evidence, map it first and note which items the mutual recognition routes exempt.
- Close the gaps that take longest: per-device default credentials and signed updates usually need manufacturing and firmware changes; a published disclosure policy and support period need legal and product sign-off.
- Test: run a port and interface review for S1.1-13 and a vulnerability scan, verify settings survive power loss (S1.1-14), and verify data deletion keeps the current firmware (S1.1-15).
- Build the evidence pack: keep a record per requirement (test result, design note, policy URL) so the self-declaration can be defended if IPA inspects it.
- Apply: obtain an application number, submit the form, checklist and any mutual recognition documents. Budget for Japanese-language forms or use a proxy.
- Operate: track label expiry against the support period, keep the disclosure contact monitored, and renew the self-declaration before two years elapse.
For buyers
If you buy IoT equipment, our suggestion is to ask for STAR-1 as a minimum for devices on corporate networks in Japan, check the label against IPA's register via the two-dimensional code, and add contract terms for the support period and disclosure contact. For devices in critical systems, plan for STAR-3 once evaluations open rather than treating STAR-1 as sufficient. See the Enterprise IoT Security Programme Guide.
Framework mapping
| JC-STAR theme | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Unique credentials and authentication (S1.1-01 to 04) | IA-3 Device Identification and Authentication; IA-5 Authenticator Management | PR.AA |
| Vulnerability disclosure (S1.1-05) | RA-5 Vulnerability Monitoring and Scanning; SI-2 Flaw Remediation | ID.RA |
| Signed updates and support period (S1.1-06 to 09, 16) | SI-7 Software, Firmware, and Information Integrity; SA-22 Unsupported System Components | PR.PS-02 |
| Secure storage and transport (S1.1-11, 12) | SC-28 Protection of Information at Rest; SC-8 Transmission Confidentiality and Integrity | PR.DS |
| Attack surface (S1.1-13) | CM-7 Least Functionality | PR.PS |
| Buying labelled products | SR-11 Component Authenticity | GV.SC-05; ID.AM-01 |
Common failure patterns
- Treating self-declaration as a formality: a checklist ticked without test evidence leaves the manufacturer exposed if IPA inspects or a customer audits.
- Declaring the device but not the service: the cloud back end and app hold the credentials and data that matter; leaving them out of the assessment leaves the weakest part unexamined.
- Publishing a support period that cannot be met: the period appears on the label record and, under the PSTI route, cannot be shortened later.
- Fleet-wide secrets: unique passwords at the user interface with a shared cloud API key in firmware meets the letter of S1.1-02 and misses its point.
- Buyers reading STAR-1 as high assurance: the baseline excludes physical attack, supply chain tampering and denial of service.
- Planning around unpublished levels: STAR-2 and STAR-4 dates have slipped before; build plans on what IPA has published.
Practitioner checklist
- Confirm product scope and what "product" includes (device, cloud service, app).
- Map existing ETSI EN 303 645, PSTI or CLS evidence to S1.1-01 to S1.1-16.
- Provision unique per-device credentials and keys at manufacture.
- Protect the firmware signing key in an HSM with logged, restricted use.
- Publish a vulnerability disclosure policy with response timelines and a monitored contact.
- Publish a realistic support period and end-of-support policy.
- Keep a per-requirement evidence pack behind the self-declaration.
- Track label validity (two years for STAR-1) and renew before expiry.
- For buyers: require STAR-1 as a minimum and verify labels on IPA's register.
Standards and references
- IPA: Japan Cyber STAR (JC-STAR) Labeling Scheme
- IPA: STAR-1 Conformance Requirements and Assessment Methods (JST-CR-01-01-2024R1)
- METI: Launch of the JC-STAR Labeling Scheme for IoT Products
- METI: IoT Product Security Conformity Assessment Scheme Policy
- IPA: JC-STAR and UK PSTI Compliance
- IPA: JC-STAR and Singapore CLS Mutual Recognition
- IPA: STAR-3 Conformance Requirements and Assessment Procedures
- IPA: New Application Procedures for STAR-1 and STAR-2
Related NHI Mgmt Group resources: US Cyber Trust Mark Guide · Singapore Cybersecurity Labelling Scheme Guide · UK PSTI Act Guide · Product Security Laws Map. This guide summarises the JC-STAR labelling scheme and is not legal advice.