Enhancing information security

  1. TOP
  2. Enhancing information security
  3. Japan Cyber STAR (JC-STAR)
  4. Application Process
  5. Regarding PSTI Compliance Certification

Regarding PSTI Compliance Certification

Release Date:Jan 27, 2026

Starting January 1st, 2026, mutual recognition with the Product Security & Telecommunications Infrastructure Act (PSTI Act) has started. The specific procedures for mutual recognition, implemented through PSTI Act conformance certification and JC-STAR conformance label acquisition, are as follows:

For the applicants wishing to apply for a JC-STAR conformance label for products with the UK PSTI Act compliance

Overview

  1. The products with PSTI compliance are recognized as meeting JC-STAR-1 Conformance Requirements S1.1-02 (non-common default passwords), Conformance Requirements S1.1-05 (vulnerability disclosure policy), and Conformance Requirements S1.1-16 (product information provision). The applicant is exempt from the conformance checklists for these three requirements in the JC-STAR checklist.
  2. Currently, only JC-STAR-1 is operational under the JC-STAR.
  3. Upon approval of conformance through the application process below, the JC-STAR-1 conformance label will be issued.
  4. For future STAR-2 or higher standards, conformance with the above three conformance requirements will also be recognized.

Procedure for JC-STAR Conformance Label Application

1. The applicant shall submit the "Application Form for Products with PSTI Compliance" and the "Checklist for Products with PSTI Compliance" to the address below. The applicant can complete them in English.

    • Application Form for Products with PSTI Compliance (in preparation)
    • How to write the Application Form for Products with PSTI Compliance (in preparation)
    • Checklist for Products with PSTI Act Compliance (in preparation)

　　Mailing Address:
　　　JC-STAR Application Section,
　　　IT Security Technology Evaluation Department, ISEC,
　　　Information-technology Promotion Agency, Japan (IPA)

2. To confirm compliance with the PSTI Act, the applicant shall submit a "PSTI Statement of Compliance" or provide the URL where it is published at the time of application. Additionally, for STAR-3 or higher applications, submission of the "PSTI Statement of Compliance" is also required to the JC-STAR Evaluation Bodies.

3. For products with PSTI compliance, the application fee is reduced. For STAR-1 applications, the fee is 140,000 yen (tax included) (the standard application fee is 198,000 yen (tax included)).

4. The initial validity period of the JC-STAR conformance label is two years. Through extension procedures, STAR-1 and STAR-2 labels can be extended in two-year increments. STAR-3 and STAR-4 labels can be extended in one-year increment, with recertification required five years after initial acquisition. Refer to the JC-STAR website for details.

For the applicants wishing to certify compliance with the UK PSTI Act for the JC-STAR conformance labeled products

Overview

  1. When certifying compliance with the UK PSTI Act for the JC-STAR conformance labeled products, the applicant shall complete and submit either the "[Optional] Application Sheet for Compliance with the PSTI Act (when applying simultaneously with the acquisition of the conformance label)" or the "Application Form for PSTI Compliance (when applying after acquiring the conformance label)" to IPA. Following verification procedures and the issuance of the conformance label by IPA, it is required that the product shall be listed on the IPA website ("List of products acquired conformance labels" and "PSTI Statement of Compliance Products List").
  2. It is required to provide information about products and vulnerabilities “in English” and to establish a vulnerability contact point, etc. Note that if an applicant provides information and establishes a vulnerability contact point "in Japanese only" for JC-STAR conformance label acquisition, it is necessary for the applicant to provide "English support" before applying for compliance with the PSTI Act.
  3. Provided that the applicant is compliant with the items listed in the "Important Notes" below, products listed on the "PSTI Statement of Compliance Products List" will be regarded compliant with the three security requirements specified by the PSTI Act ("Prohibition of common default passwords setting at shipment," "Provision of vulnerability reporting methods," and "Indication of the security support period of the product") by externally displaying the JC-STAR conformance label in a manner directly confirmed by the public when distributed in the UK.
  4. Currently, only the "STAR-1" conformance label is mutually recognized with the PSTI Act. Therefore, if the applicant wishes to certify the PSTI compliance for products with a STAR-2 or higher conformance label, we will issue a "STAR-1" conformance label with the same registered ID upon completion of the "PSTI compliance" confirmation process. The applicant can use the "STAR-1" conformance label for the products with PSTI compliance distributed in the UK.

Important Notes

  • Under the PSTI Act, it is mandatory that the Statement of Compliance (or its copy) shall be retained for 10 years from the date of issue or until the end of the support period, whichever is longer. IPA will continue to publish the "List of products acquired conformance labels" for this period.
  • Under the PSTI Act, shortening the support period after its publication is not permitted.
  • The PSTI Act imposes obligations to investigate compliance with security requirements when non-compliance is suspected and to correct security breaches once recognized.
  • Manufacturing vendors are required to retain records for 10 years when implementing vulnerability responses or surveillance responses. Additionally, IPA will retain the application-related documents for 10 years for records described in the security information on the "List of products acquired conformance labels."
  • The UK OPSS (Office for Product Safety and Standards) conducts market surveillance. If non-compliant products are discovered or violations are uncovered through reports, fines will be imposed.
  • Note that Northern Ireland is excluded from the application of the PSTI Act.
  • For further details, make sure to read the PSTI Act. It is also required to comply with matters stipulated in the PSTI Act and other English Laws (such as establishing a Product Security Incident Response Team (PSIRT) for security measures after product shipment)

Procedure for submitting the application of PSTI compliance simultaneously with the application of conformance label acquisition

  1. The applicant can apply simultaneously by also completing the "[Optional] Application Sheet for PSTI Compliance" within the Conformance Label Application Form.
  2. Note that the "[Optional] Application Sheet for PSTI Compliance" requires a handwritten signature. The applicant shall print this sheet and submit a file (PDF recommended) bearing the applicant's (or application agent's) handwritten signature along with the application.
  3. In addition to the application fee, an administrative fee of 5,500 yen (tax included) is required. This will be billed together with the application fee.
  4. Once a conformance label is issued, the product will be listed on both the "List of products acquired conformance labels" and the "PSTI Statement of Compliance Products List."

Procedure for submitting the application for PSTI compliance after the conformance label acquisition

  1. For each conformance label, the applicant shall prepare the following "Application Form for PSTI Compliance" and send it to the following address. Note that this application form requires a handwritten signature. The applicant shall print this application form and submit it along with a file (PDF recommended) bearing the handwritten signature of the applicant (or application agent).
    • Application Form for PSTI Compliance (in preparation)
    • How to write the Application Form for PSTI Compliance (in preparation)
  2. An administrative fee of 5,500 yen (tax included) per application is required.
  3. The information provided in this application takes precedence over any content already published on the product information page. Note that if discrepancies exist, the information in this application will be used to update the records, even if no change notification has been submitted.
  4. If the procedure is delegated, the applicant shall prepare a valid authorization letter.

　　Mailing Address:
　　　JC-STAR Application Section,
　　　IT Security Technology Evaluation Department, ISEC,
　　　Information-technology Promotion Agency, Japan (IPA)

Change log

  • Jan 27, 2026

    It is newly released