Complete Guide to the Supply Chain Cybersecurity Evaluation System (SCS): Checklist for Small and Midsize Businesses Ahead of October 2026 Launch

What is the SCS evaluation system? A new security standard affecting business terms

On March 27, 2026, the Ministry of Economy, Trade and Industry (METI) officially announced its policy framework for the "Supply Chain Cybersecurity Evaluation System (SCS Evaluation System)." Targeting full operations in October 2026, this framework visualizes an enterprise's cybersecurity implementation status across three levels: 3 to 5 stars.

This marks a major national shift away from the traditional mindset of "every company protects its own security" toward guaranteeing security baselines across the entire supply chain.

Why it matters to small and midsize businesses

Large enterprises have already begun demanding security evaluations from their business partners. Once the SCS evaluation system is formally operational, lacking a 3-star rating may become a barrier in business negotiations. According to an IPA survey, 69.7% of small and midsize businesses reported having "no systematic security measures in place," meaning many enterprises will soon be compelled to take action.

Rating levels from 3 to 5 stars and scope of measures

The immediate milestone for most small and midsize businesses is 3 stars. Companies must implement required measures internally and establish a posture where they can explain their compliance (self-declaration of conformity).

Overview of the 25 requirements to obtain a 3-star rating

The 3-star baseline criteria outlined by METI are based on the IPA's "Information Security Measures Guidelines for SMEs." They are broadly categorized into five domains.

1. Organizational measures

• Formulating information security policies: Document internal policies and ensure all employees are fully informed
• Clarifying organizational responsibilities: Appoint a security officer and establish incident escalation workflows
• Employee training: Conduct security awareness training at least once a year

2. Technical measures

• Deploying firewalls and WAFs: Prevent unauthorized external access
• Installing antivirus software: Ensure endpoint protection
• OS and software patch management: Establish operational practices to avoid leaving vulnerabilities unpatched
• Access controls: Design permissions based on the principle of least privilege

3. Website security

Corporate websites are frequent primary targets for attackers seeking entry points.

• Applying SSL/TLS certificates: Implement site-wide HTTPS
• CMS update management (e.g., WordPress): Regularly update core systems and plugins
• Securing contact forms: Protect against SQL injection and XSS
• Restricting admin panel access: Implement IP whitelisting and two-factor authentication

4. Data management

• Performing regular backups: Apply the 3-2-1 backup rule for ransomware protection
• Establishing personal data handling rules: Clarify storage locations and access rights
• Documenting disposal procedures: Establish secure disposal processes for equipment and digital assets

5. Incident response

• Developing incident response plans: Document procedures from detection through reporting and recovery
• Organizing contact directories: Predefine reporting channels for the IPA, law enforcement, and business partners
• Conducting regular drills: Run incident response drills at least once a year

Specific security upgrade points for websites

Among the SCS evaluation checklist items, website security is an area where many small and midsize businesses lag behind. Let's look at what specifically needs to be audited.

Full HTTPS enforcement

Confirm that all pages are served over HTTPS. Leaving mixed content behind not only causes browsers to display warnings, but also prevents you from meeting the certification requirements.

# 混在コンテンツの確認方法
# Chrome DevTools → Console → Mixed Content警告の有無を確認

CMS security measures

If you use WordPress, the following countermeasures are mandatory.

1. Regularly updating core, plugins, and themes — Run update checks at least monthly
2. Removing unnecessary plugins — Immediately delete unused plugins
3. Implementing two-factor authentication on admin panels — Utilize solutions such as Google Authenticator
4. Limiting login attempts — Prevent brute-force attacks
5. Deploying a Web Application Firewall (WAF) — Use cloud WAFs such as Cloudflare

Configuring security headers

# 推奨するHTTPセキュリティヘッダー
Content-Security-Policy: default-src 'self';
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains
Referrer-Policy: strict-origin-when-cross-origin

Taking advantage of support programs

A new service category, the "Cybersecurity Otasuke-tai Service (New Category)," is scheduled to launch as a support initiative for small and midsize businesses. This service provides affordable, straightforward assistance with evaluations and remediation required for 3 stars, making implementation manageable even for companies without in-house specialists.

In addition, a consultation channel with IPA-certified "Registered Information Security Specialists (Registered RISS)" will be made available. Organizations can receive expert advice on whether they meet 3-star compliance, making it an invaluable resource when uncertain about self-assessment.

Starting with the SECURITY ACTION declaration

As a preliminary step before the SCS evaluation system, it is also effective to start with IPA's "SECURITY ACTION" declaration (1-star or 2-star). Over 800,000 businesses have already declared compliance, and it also serves as an application prerequisite for IT Implementation Subsidies.

Estimated implementation schedule

Conclusion: The era where defensive IT investments safeguard business transactions

The SCS evaluation system transforms cybersecurity from an operational overhead into an essential investment to retain business relationships. In particular, a corporate website serves as both the public face of an enterprise and a prime attack vector.

Keep three key principles in mind when preparing:

1. First, assess your current posture — Take an inventory to evaluate the extent of existing security controls
2. Start with your website — Prioritize hardening externally facing assets
3. Leverage support programs — Actively utilize the Otasuke-tai service and Registered Information Security Specialists

There are roughly six months remaining until the framework launches. Starting preparations now leaves ample time to comply. For website security assessments and remediation, refer to our introductory guide to website security. Additionally, organizations using Google Workspace can review recommended practices in our Google Workspace security configuration checklist.

If you need assistance upgrading the security of your corporate website or IT infrastructure, please contact us. We provide end-to-end support, ranging from initial gap assessments to remediation required for a 3-star rating.