"ISMAP" Articles (5) | TIMEWELL Inc.

ISMAP Never Says "Keep the Data in Japan": I Searched All 45 Pages of the Control Standard

The service passed Japanese government procurement, so the data must be in Japan. Read the actual program documents and that inference falls apart. Across all 45 pages of the ISMAP control standard, the words for "Japan", "outside the country" and "cross-border" never appear once, and the clauses that touch location go no further than notifying customers which countries may hold their data and assessing the risk of foreign law reaching it. Here are the clause numbers.

2026-09-06Ryuta Hamamoto

AI Security

What Sakura Internet's Breach Disclosure Teaches Us | Designing for the Day Your Cloud Provider Is Compromised

In August 2026, Sakura Internet disclosed unauthorized access to its hosting environment and later to its sales management system. This is not a piece about what the company did wrong. It walks through why provider-side intrusions happen, what legal duties stay with the customer, and how to read the scope of an ISMAP registration before you rely on it.

2026-08-19Ryuta Hamamoto

TRAFEED

ISMAP and the SCS Evaluation System Explained from Scratch: Security Requirements for Government Procurement and Supply Chains

A beginner's guide to ISMAP, the pass-list for government cloud procurement, and the SCS evaluation system (★3/★4) launching around FY2026's end.

2026-07-16Ryuta Hamamoto

AI Security

ISMAP Explained — Clearing the Government Cloud Procurement Qualifier, How ISMAP-LIU Differs, and AI Integration Issues

ISMAP (Information system Security Management and Assessment Program) launched in June 2020; 77 services were listed as of June 2025.

2026-05-20Ryuta Hamamoto

TRAFEED

Export Control for SaaS and Software Companies: Deemed Export, ISMAP, and Cloud Regulations in Practice [2026 Edition]

Working through this series on industry-specific export control has reminded me how unusual SaaS is. The goods don't move, but the technology does.

2026-04-24Ryuta Hamamoto