IPA Publishes Version 4.0 SME Security Guidelines

The Information-technology Promotion Agency, Japan (IPA) revised and published Version 4.0 of the Information Security Guidelines for Small and Medium-sized Enterprises, which presents specific procedures and other guidance to help SME managers and staff understand the need for information security measures and manage information safely. The basic structure has been maintained.

The background includes ransomware damage expanding beyond information leaks to the suspension of companies’ business activities; the spread of cybersecurity-related damage through supply chains in Japan and abroad, increasing the need to promote measures across the entire supply chain; and a serious shortage of personnel within SMEs and other organizations to advance these measures.

Version 4.0 revises the content to reflect these latest environmental changes and enable companies to advance practical cybersecurity measures with an appropriate understanding of the risks.

IPA expects SMEs’ steady advancement of information security measures through use of these guidelines to improve the reliability of the SMEs themselves and contribute to reducing cyber risks across the economy and society.

“Take Backups!” was newly added to the “Five Information Security Principles to Address First,” making them the “Six Information Security Principles.”

Two items were newly added to the “Information Security Company Self-Assessment You Can Complete in Five Minutes”: “Block unnecessary communications from external sources to the internal network” and “Operate websites securely.”

The content was aligned with the basic principles of the “Security Measures Evaluation System for Strengthening Supply Chains (SCS Evaluation System),” which the Ministry of Economy, Trade and Industry and the National Cybersecurity Office of the Cabinet Secretariat are considering.

Based on the “Beta Version of Practical Measures for Securing and Developing Personnel According to the Security Measures Implemented by Mid-sized and Small Enterprises,” published in May 2025, an appendix was added with measures and examples of initiatives to support securing and developing cybersecurity personnel.

Version 4.0 reflects changes that occurred after Version 3.1, published in April 2023. Reference materials include the FY2024 survey of information security measures at SMEs, discussions concerning the SCS Evaluation System, and a study group on promoting the development of cybersecurity personnel.