ISMAP: preparing a cloud service for government procurement in Japan
Identify the service, registration route and evidence needed for the proposed contract.
Before proposing a cloud service to a Japanese government buyer, check the exact service, registration scope and tender requirements. A secure product description is not enough to establish procurement eligibility. ISMAP registration and the buyer’s decision to award a contract are separate matters.
From service scope to procurement evidence
SC-TL-02 · REV A · 2026.07
01Service scope
functions and operators
02Applicable route
ISMAP or eligible LIU
03Audit and application
evidence and review
04Tender response
contract-specific conditions
Illustrative work sequence; not a registration timetable.
Check the registered service and its scope
ISMAP evaluates and registers cloud services against government security requirements. Procurement from the ISMAP or ISMAP-LIU lists is the principle stated in the official overview. Check the actual listed service, registration status, covered functions and conditions. A registered infrastructure provider does not, by itself, establish the registration of an application running on it.
Confirm whether ISMAP-LIU fits
ISMAP-LIU is intended for SaaS used to process low-impact business activities and information. It is not a general shortcut for any government workload. Confirm the proposed use, eligibility and current procedure with the buyer and the scheme’s official guidance. Do not build a forecast around an assumed three-month registration or a fixed comparison with the full route.
Prepare an audit and application plan
The full registration procedure requires an audit by an organisation on the ISMAP auditor list. The official process recommends early consultation before the main audit where issues may affect registration. Identify the service boundary, control owners, operating evidence and application documents. Ask the auditor about the required evidence and languages rather than promising that existing overseas certifications or English documents are sufficient.
Separate registration from the tender
A tender can add conditions on functionality, data handling, support, pricing and delivery. Map each condition to a product configuration, document and responsible party. Agree how service changes and registration obligations will be handled after purchase. A local reseller can help coordinate the proposal; it cannot confer registration or waive the buyer’s procurement rules.
Sources and further reading
// Key Takeaways
What to remember
- Check the exact service and registration scope.
- Use ISMAP-LIU only where the workload and service qualify.
- Plan audit evidence and tender requirements separately.
// FAQ
Frequently asked questions
Does an ISMAP-registered infrastructure provider cover every application on it?
No. Check the exact registered service, its scope and the buyer’s procurement requirements. Infrastructure registration alone does not establish application registration.
Is ISMAP-LIU available for every government use case?
No. The scheme concerns SaaS for low-impact activities and information. Confirm eligibility and the proposed use against current official guidance.
Last updated:
Prepare product information for Japan’s public-sector procurement.
Discuss the proposed service, its current registration status and the requirements of the particular procurement. StrategyCore can coordinate Japanese product and partner discussions and obtain technical and contractual information from your team.