What Is TICS? Japan's Technical Information Management Certification

Hello, this is Ryuta Hamamoto from TIMEWELL.

Has a customer ever asked whether a third party certifies how you manage technical information? Or, as the party holding someone else's drawings or research data, have you wondered whether you should get some kind of certification? One of the names that comes up in Japan is TICS, the Technology Information Control System, known in Japanese as 技術情報管理認証制度.

The short answer first. TICS is a scheme in which certification bodies accredited by the Japanese government review how a business manages its technical information, using a national standard. It was created by a 2018 amendment to the Industrial Competitiveness Enhancement Act, and as of November 6, 2026 it is still in operation. The number of certification bodies has been shrinking, though, and the latest count of certified businesses I could verify is 51, counting only those that agreed to be listed. I also found no provision saying certification automatically makes your information a protected trade secret. The real value is in explaining your controls to customers, and in giving your company a reason to take stock of how it handles sensitive information.

This article walks through the framework, what the standard asks for, how to apply and what it costs, how TICS differs from ISO/IEC 27001, the benefits and limits, and a realistic path for small companies and universities. Government guidance on technology leakage in general is covered in a separate article, so I stay with the certification scheme here.

Key terms first, and the big picture

Here are the terms that keep coming up. Legal and notice language is stiff, so I have added everyday comparisons. They are aids to understanding, not formal definitions.

Term	Meaning	Everyday comparison
TICS	Technology Information Control System, the English name of the scheme	A quality accreditation, but for technical information
Certification body	An organization accredited by the government to review and certify; private groups and trade associations do this	The test center for a driver's license
Standard notice	The national standard used for review, issued jointly by several ministries	The marking sheet
Controlled information	The technical information a business decides to put under the standard	The papers you decide to lock in a safe
Responsible manager	The person accountable for managing that information	The keyholder of the safe
Mandatory item	An item the standard says must be achieved	A required subject for passing
Periodic report	A yearly report on how controls are running after certification	An annual inspection
ISMS	A system for managing information security overall; ISO/IEC 27001 is the best-known standard	A security plan for the whole building

One more comparison. TICS does not examine the security plan for the whole building. It examines what happens to the documents in a particular safe: who can open it, who takes things out, and how they are destroyed. What goes into the safe is your own decision. That is the biggest difference from ISO/IEC 27001, which I get to below.

On the legal footing: Article 2 of the Industrial Competitiveness Enhancement Act defines technical information leakage prevention measures as the measures a business takes to prevent leakage of technology, R&D results, production methods and other information useful to its business. It then defines the certification work as certifying that another business's measures meet the standard set by the competent ministers, together with the guidance and advice that accompany that work.¹ The word TICS does not appear in the statute. It is the common name for this set of provisions.

On how it began: METI's June 2024 document says that a 2018 amendment of the Act created a scheme under which businesses can have their management of technical information certified by third-party bodies accredited by the competent ministries, against a national standard.² The starting point is simple. Instead of a company saying "we are fine," a third party checks against a national yardstick.

The framework and where it stands today

The scheme has several layers with different roles. The first is the statute. Article 67 has the competent ministers issue a promotion guideline, covering the basic direction for promoting these measures and the criteria for accrediting certification bodies, and it requires attention to the needs of small and medium-sized businesses.¹

The second layer is the certification bodies. Under Article 68, a body that carries out certification work can obtain accreditation from the competent ministers, and its name, address and scope of work are published. Accreditation must be renewed at intervals set by cabinet order, not exceeding three years (Article 69). Officers and staff of a body must not leak or misappropriate secrets learned in the work (Article 72), and the government can order improvements (Article 73) or revoke accreditation (Article 75). Presenting yourself in a way that is clearly likely to be mistaken for an accredited body when you are not is subject to an administrative fine of up to 100,000 yen (Articles 79 and 162).¹

Public support agencies sit around the scheme. The Information-technology Promotion Agency (IPA) can provide information on cybersecurity when a certification body asks (Article 77), and the Organization for Small & Medium Enterprises and Regional Innovation (SMRJ) can support information provision on the guidance side for small businesses (Article 78).¹

The review criteria themselves live in notices, not in the statute. METI's June 2024 document names three: the standard on measures needed to prevent leakage of technology and related information (the standard notice), the method of carrying out certification work, and the promotion guideline. All three were issued in 2018 jointly by nine ministries, from the Cabinet Office to the Ministry of the Environment.² That many names appear because the scheme is meant to cover technical information in many fields, not only manufacturing.

Is the scheme still running? As far as I could verify, yes. In fiscal 2025, METI commissioned Mitsubishi UFJ Research and Consulting to run a project to promote the scheme and dispatch experts, and on August 19, 2025 the firm opened applications from companies wanting an expert.³ The standard notice was rewritten in 2024, as described in the next section.

The numbers have moved, though. METI's June 2024 document said that as of the end of April 2024, eight bodies were accredited and a total of 42 companies had obtained certification.² An industry association's June 2025 column, citing METI's list, gives 51 businesses (those that agreed to be listed), with 15 certified in fiscal 2020 and 12 in fiscal 2021, more than half in the first two years, and 10 in fiscal 2024, back in double digits for the first time in three years.⁴ The number of bodies was seven in August 2025 according to a private-sector explainer,⁵ and six as of May 2026 according to a certification body's guide.⁶ From search results I saw that METI's page lists accreditations lapsing at the end of their validity, but I could not confirm which bodies.⁷ I could not read METI's page directly, so the latest count of certified businesses is unconfirmed.

I had guessed that international organizations might run the system, but that is not so. The accredited bodies include general incorporated associations and foundations, a public interest foundation and a stock company, and trade associations in the die and metal-press industries have been accredited.⁴⁵ An association qualifies if its structure matches the required way of carrying out the work.⁴ The system is national, but the reviewing is done by accredited bodies outside the government. You choose which body to ask, so compare cost and sector experience. For the current list, see METI's page.

What the standard looks for

The certification standard changed substantially in 2024. According to METI, certification bodies and industry groups had said the standard was needlessly complicated, so expert committees reviewed it. The old standard notice was abolished and a new one drafted, with the method and guideline notices amended in part. The public comment period ran from June 5 to July 4, 2024.²⁸ There were four main changes.

First, clarity. Mandatory items are now separated from the means considered suitable for achieving them, similar items are merged, and the language is simpler. Second, industry needs: the draft covers all Level 1 items of the cybersecurity guidelines of the automobile manufacturers' and parts makers' associations. Third, modernization: numerical requirements for facilities and equipment, no longer suited to current security conditions, were deleted, and controls from Annex A of ISO/IEC 27001:2022 that fall under the "detect" and "respond" attributes of the cybersecurity concept were referenced and added.² Fourth, conforming changes to the other notices that cite the standard.

Let me describe the structure using the draft released for public comment. I could not retrieve the final notice from METI's page, so details may differ from the final text. Please read this as a rough outline.

Part	What it covers	Mandatory items (draft)
I General	Policy, identifying controlled information, confidentiality levels, organization, incident response, training, business partners, logs, disposal	11
II Access rights	Who may see what, granting and reviewing rights, pledges, sharing and copying	4
III Physical items	Locking of paper, prototypes and equipment, restricted areas, transport, intruders	3
IV Electronic information	Login, server rooms, networks, backups, logs, encryption, portable media, maintenance, passwords	14
V Handing over to others	Checking contractors, confidentiality agreements	2

The draft had 34 mandatory items in total. That sounds like a lot, but each item comes with concrete examples of how to achieve it. A few illustrations follow.

General item 2 is about identifying controlled information. The business lists it, recording its form, the responsible manager's name, storage place, retention period and who it is disclosed to. In deciding what to include, it considers four questions: would a leak seriously affect our competitiveness, would tampering, would loss of use, and would a leak of information entrusted to us by others damage trust. Electronic files, prototypes and paper documents must each be marked so that they can be told apart from other information.⁸ In my safe analogy, that is deciding which papers go into the safe and putting a label on the spine.

General item 9 asks for each business partner to be handled separately: grasp which technical information and which channels you exchange, and, if you hold information entrusted by the partner, decide controls after hearing its views. For small suppliers that hold customers' drawings, this item carries weight. Items 10 and 11 require a ledger recording removal, copying and disposal, and disposal in a way that prevents restoration, such as shredding paper, overwriting electronic data, and physically destroying portable media.⁸

Part II brings in the need-to-know principle. Before granting access, the business considers matters such as whether the person may soon leave and whether they have a record of breaking internal rules, and keeps access to the minimum. It keeps a roster of people with access, updates it with personnel changes, and obtains confidentiality pledges.⁸ This overlaps with trade secret management, which I discuss later.

Part III covers physical items: ledgers for key loans, changing lock codes when the person in charge changes, and restricted areas. Part IV covers electronic information: locked server areas, access log retention and periodic review, encryption and logging for external transmission, and ledgers for portable media. For cloud storage, the provider's trustworthiness must be checked, with the status of ISO/IEC 27017 certification given as one example.⁸ Part V covers handing information to others: check the contractor's information management before handing anything over, and sign a confidentiality agreement or an equivalent binding arrangement, with prior approval required for subcontracting.⁸

My honest impression after reading it is that this is not a standard demanding exotic technology. It is keys, rosters, ledgers, contracts and training, built up steadily. The hard part is not the sophistication but keeping it going, which is why the scheme builds in a yearly report.

How to get certified: process, time, cost, renewal

Following one certification body's guide, the process runs: apply, self-check, document-focused review, on-site review, remediation, then certification.⁶ At launch there were five stages: application, preliminary review, document review, on-site review, and decision with certificate issuance. A July 2022 revision reduced duplicated procedures and paperwork, according to an industry association's page.⁹

Step	What you do	Notes
0 Preparation	Decide what to protect; check your current state with the self-check list	METI's self-check list has 10 basic and 9 practical items10
1 Choose a body and apply	Ask several bodies for conditions and quotes	You choose the body
2 Review	Documents and operations are checked; the reviewer interviews staff and visits	Limiting the covered department can reduce the burden6
3 Remediation	Fix the points raised	Improvements are specified concretely6
4 Certification	Certificate issued	Valid for three years9
5 Yearly report	Report on controls every year	Operated by each body9
6 Renewal review	Renewal every three years	Keep records with renewal in mind

On timing, the guide says one to two months from application to certification is typical, but it varies with company size, existing security measures and the body.⁶ In practice, the preparation before applying takes the time: deciding what to protect, building ledgers and arranging pledges and contracts.

On cost, I will stay within what official sources show. From search results, I saw that METI's scheme page says costs differ with company size and certification body and need roughly several hundred thousand yen (I could not read the page itself because of access restrictions).⁷ I do not quote individual bodies' fees. Request quotes and compare. In-house preparation costs and any needed equipment come on top of the review fee.

There is also public support. First, the expert-dispatch program. In fiscal 2025 it sent experts, such as practitioners in intellectual property and technical information management and information security auditors, free of charge to companies wanting to obtain or renew certification or to improve their information management. First-time applicants get pointers and proposals on identifying controlled information and building controls that match the scheme. Certified companies get audit support to check that controls are running properly.³ I could not confirm whether it continues in fiscal 2026 or on what terms, so check the latest call with the secretariat.

Second, subsidies. Under the fiscal 2022 Go-Tech program, certification costs could be claimed as eligible expenses at a general rate of up to two thirds.⁹ Private explainers also say some national subsidy programs give extra points in screening.⁵ Conditions change every year, so check the current call for applications.

On renewal: the 2022 revision wrote into the notices that certification is valid for three years and that a periodic report is due yearly.⁹ It does not end with the certificate. A yearly report and a renewal review every three years follow, and you should estimate that burden realistically before applying.

A "self-confirmation" route without certification has also been discussed. An industry association's page, written as of August 2023, describes it as the company checking its own conformity, bearing the responsibility itself, and not being allowed to use the certification mark, with guidelines and a checklist planned.⁹ I could not confirm how it operates today.

How TICS differs from ISO/IEC 27001 (ISMS)

Here is the point that confuses beginners the most.

First, my own position. TIMEWELL holds ISO/IEC 27001 certification (registration certificate number JP26/00000255; scope: planning, development and provision of SaaS products using AI technology). We do not hold TICS. This article is written by a company that has ISMS certification, reading TICS from the outside. If any sentence reads as though we hold TICS, please tell me.

Point	TICS	ISO/IEC 27001 (ISMS)
Nature	A Japanese national scheme based on a statute and notices	An international standard
What is examined	How the business protects the technical information it designated	The organization's overall information security management system
Form of the standard	Mandatory items set by the government	You assess your own risks and choose controls
Reviewing bodies	Government-accredited bodies (about six at present)	Many accredited certification bodies
Where it is recognized	Mainly Japanese manufacturing and supply chains	Worldwide
Suits	Deals where drawings and technical data are handed over	IT services, cloud, overseas business

One difference deserves emphasis. ISO/IEC 27001 certifies a management system: the organization assesses its own risks, picks controls that fit those risks, and keeps operating them. It is flexible and works for any industry. TICS has the government fix the mandatory items in advance. It is concrete about what to do, but leaves less room to choose. TICS also examines only the "important technical information" the business designates, as the certification body's guide says.⁶

The two are not unrelated. As noted above, the 2024 revision referenced the controls of Annex A of ISO/IEC 27001:2022 that fall under "detect" and "respond."² A company already running an ISMS may have groundwork in place for several TICS areas such as training, incident response, access control, logging and supplier management. On the other hand, ISMS is an organization-wide system, while TICS also covers physical items such as drawings, prototypes and equipment. The draft standard detailed locked storage, restricted areas and transport.⁸

Which should you choose? My view is that the answer lies with your customers. If a customer asks for a particular certification or standard, matching it is the shortest path. A domestic manufacturer that holds customers' drawings will find TICS easy to explain. A company serving overseas customers or providing cloud services will find ISO/IEC 27001 travels better. Also, the design policy for the supply chain security rating system (SCS), scheduled to begin operating around March 2027, gives as an example of how to choose that a company receiving a customer's important technical information should work toward TICS or a four-star SCS rating. I covered that in the article on cyberattacks and technology leakage as preparation for when a customer asks. For the wider picture of these schemes, see the guide to ISMAP and the SCS rating.

Benefits and limits, and the link to trade secrets

First the benefits. Explainers that draw on METI case studies report companies saying they could respond to customers' requests about information management, that showing the certification mark reassured customers, and that advice received during the process moved their controls forward.⁵ A caution: these are voices from companies that obtained certification, and some come from vendors' explainers. They are not statistics proving an effect. The two benefits I consider solid are these.

One is easier explanations to business partners. Being able to say "our technical information controls are checked by a third party against a national standard" helps, especially when a small parts maker holding a large customer's drawings wants to show trustworthiness. The other is that it forces an internal inventory. Writing down which information is handled by whom, where and how is valuable whether or not you end up certified.

The limits are three.

First, certification does not guarantee trade secret protection. Japan's Unfair Competition Prevention Act defines a trade secret as technical or business information useful for business activities that is kept secret and is not publicly known.¹¹ Being kept secret, which lawyers call secrecy management, is one of the requirements. The practices the TICS standard asks for, such as designating controlled information, marking it, restricting access and obtaining pledges, can help show secrecy management. But I found no provision, in what I checked, saying that holding TICS certification establishes it. Whether secrecy management is recognized in court depends on the facts of each case. I wrote about the requirements and practice in the article on the Unfair Competition Prevention Act and trade secrets. My understanding is that certification is a tool for raising the quality of your controls, not a legal guarantee.

Second, it does not replace export control procedures. Licenses for providing technology abroad or to non-residents fall under the Foreign Exchange and Foreign Trade Act, a separate regime. TICS is about keeping information from leaking, and export control is about determining before it leaves whether a license is needed. Some companies need both.

Third, the scope is limited. The review covers the controlled information the business designated, so it does not mean the whole company is safe. The table below collects common misunderstandings.

Common misunderstanding	Reality
TICS shows that the whole company's security is sound	It examines the management of the information the business designated, not the whole company
Certification guarantees trade secret status	I found no provision making certification decisive for secrecy management; courts decide case by case
Certification removes export control procedures	A separate regime; licenses and determinations are still required
The government does the review	Government-accredited certification bodies do
Once obtained, it is done	Valid for three years, with a yearly report and renewal review
It is the same as ISO/IEC 27001	A national scheme versus an international standard, different in what is examined and how the standard is built

One more opinion. TICS is useful for companies that customers are pressing for it, and for companies that want to tidy their controls but do not know where to begin. I do not recommend getting it "just to be safe." The yearly report and three-year renewal are not light. Checking your position with the self-check list and building the needed controls first is better value.

A realistic path for SMEs and universities

This last part is practical. The examples below are hypothetical, built around situations readers may face, and do not describe any real company.

Imagine a metalworking company with about 40 employees that machines prototype parts from drawings supplied by a large manufacturer. One day the customer's purchasing department sends a questionnaire about how drawings are managed. Deciding right away to get certified is premature, in my view. A realistic order is as follows.

1. Ask the customer what it actually wants: the certification itself, or an explanation of your controls; whether TICS is named or some other standard.
2. List the drawings you hold and your own technical documents: who stores them where, and who can access them. This is the same idea as the controlled information list in the draft standard.
3. Run METI's self-check list, the 10 basic and 9 practical items, to see the gaps.
4. Close the gaps: key control, an access roster, pledges, ledgers, disposal procedures, training. This has value even if you never certify.
5. Then decide whether to certify. If so, get quotes from several bodies, ask whether the scope can be narrowed, and check the latest call for the expert-dispatch program.

The reason for this order is simple. If steps one to four are done, the review is largely a confirmation. If you go straight to review, you scramble to build controls at each audit.

Now universities and research institutions. Many readers will wonder whether a university is even meant to hold TICS, which is aimed at businesses. The statute's definition concerns measures taken by business operators, so how research bodies fit needs separate checking. The government's research security procedure document mentions TICS only in a footnote as a related initiative, and says neither that obtaining it is required nor that it is desirable. I went through the primary sources in a separate article (how to read the research security procedures). The realistic first step for a university is not whether to certify, but deciding which materials received in joint research, and which research data, fall within the scope to protect. That work overlaps with the way TICS thinks.

Where joint research, international students and visiting researchers are involved, leakage through people adds another angle. How government guidance organizes this across organizations and people is covered in the article on the technology leakage prevention guidance.

Summary and a first step

TICS lets a third party examine your technical information management against a national standard. It rests on a statute, its standard was made clearer in 2024, and expert dispatch ran again in fiscal 2025, so it is still operating. At the same time, the number of certification bodies has fallen and certified businesses are not many. I see it as a tool for explaining your controls to partners and for tidying your internal practices, not a universal guarantee.

The first step on Monday morning is not to call a certification body. Write on one sheet of paper the technical information you hold for others, or have handed to others: its name, where it is, who holds it, and who has received it. Once you can do that, the next decision gets easier whether or not you go for TICS.

METI's TICS page could not be read directly during this research because of access restrictions. For the latest list of certification bodies, the latest number of certified businesses and the final text of the standard notice, please check METI's public page. Where I could not confirm something, I have said so in the article.

If you want to link export control and technology leakage controls in one ledger, the TRAFEED service page may help, and you can contact us here. Final classification decisions are made by your company's export control manager.

Footnotes

1. Industrial Competitiveness Enhancement Act (Act No. 98 of 2013), e-Gov Law Search. Article 2, paragraphs 26 and 27 (technical information leakage prevention measures and certification work); Article 67 (promotion guideline); Articles 68 to 75 (accreditation, renewal, confidentiality, improvement orders, revocation); Articles 77 and 78 (IPA and SMRJ support); Articles 79 and 162 (restriction on indications, administrative fine). Text checked through the e-Gov law API on November 6, 2026. The Japanese text is authoritative. ↩ ↩² ↩³ ↩⁴

2. Outline of the establishment and amendment of notices on the Technology Information Control certification scheme (METI, June 2024). Attached to the public comment procedure. Covers the creation of the scheme by the 2018 amendment, eight accredited bodies and 42 certified companies as of the end of April 2024, and the four pillars of the standard revision including reference to Annex A of ISO/IEC 27001:2022. Checked November 6, 2026. In Japanese. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

3. Call for companies wishing to receive expert dispatch under the fiscal 2025 Technology Information Control certification scheme (Mitsubishi UFJ Research and Consulting, August 19, 2025). Full text in a PDF. The firm was commissioned by METI for the fiscal 2025 project; experts are dispatched free of charge. Checked November 6, 2026. In Japanese. ↩ ↩²

4. Secretariat column, June 2025: Trends in the Technology Information Control certification scheme (APPTraS). Gives 51 businesses on METI's list (those that agreed to be listed), the breakdown by fiscal year, accreditation status of bodies, the 2024 standard revision and the May 2025 revision of the self-check list. Checked November 6, 2026. In Japanese. ↩ ↩² ↩³

5. What is TICS? A certification that makes you a preferred supplier, and how to obtain it (DataClasys, published August 15, 2025, updated July 13, 2026). An explainer by a security product vendor that includes promotion of its own products. Used only as a private-sector explanation for the list of seven bodies as of August 15, 2025, the extra points in some subsidy programs, and company testimonials drawn from METI's case studies. Checked November 6, 2026. In Japanese. ↩ ↩² ↩³ ↩⁴

6. Certification review under the Technology Information Control certification scheme (Ride Co., Ltd.). A certification body's own guide. Cited for the process, the one to two month guideline, the scope being limited to important technical information, three-year validity, and the statement that there were six bodies as of May 2026 (Reiwa 8). The company's fees and any comparison of bodies are not covered here. Checked November 6, 2026. In Japanese. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

7. Technology Information Control certification scheme (METI). METI's site returned HTTP 403 during this research, so I could not read the page body. The lapse of accreditations, the cost guideline (roughly several hundred thousand yen), and the existence of lists of certification bodies and certified businesses were confirmed from search result summaries. The latest figures must be checked on the page itself. November 6, 2026. In Japanese. ↩ ↩²

8. Draft standard on measures needed to prevent leakage of technology, R&D results, production methods and other useful information (e-Gov public comment, June 5 to July 4, 2024). This is the draft released for comment. The final notice must be checked on METI's page, which could not be retrieved this time because of access restrictions. The comment procedure notice is here. Checked November 6, 2026. In Japanese. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

9. About the Technical Information Management Certification scheme (Japan Die & Mold Industry Association). The July 2022 revision, three-year validity and yearly periodic report, the treatment of certification costs under the fiscal 2022 Go-Tech program, and the self-confirmation concept. Parts of the page reflect the situation as of August 2023, and it is written from the standpoint of a certification body. Checked November 6, 2026. In Japanese. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

10. METI publishes a self-check list for the Technology Information Control certification scheme (ScanNetSecurity, April 4, 2023). Reports METI's "Technical Information Management Self-Check List" released March 29, 2023 (10 basic and 9 practical items). The May 2025 revision is described in the secretariat column. Checked November 6, 2026. In Japanese. ↩

11. Unfair Competition Prevention Act (Act No. 47 of 1993), Article 2, paragraph 6, e-Gov Law Search. Definition of a trade secret. Checked through the e-Gov law API on November 6, 2026. The Japanese text is authoritative. ↩