JC-STAR (Japan IoT security labeling), explained

IPA's own program page lays out four conformance tiers. STAR-1 is a unified, baseline set of requirements addressing minimum threats common to all in-scope IoT products — explicitly built to harmonize with international baselines like ETSI EN 303 645 and NIST's NISTIR 8425, rather than reinvent a Japan-only requirement set from scratch. STAR-2 adds category-specific requirements on top of STAR-1 for particular product types. Both STAR-1 and STAR-2 run on vendor self-declaration: IPA grants the conformance label based on a checklist describing the results of the vendor's own self-assessment against the scheme's published requirements and assessment procedures, rather than an independent audit.

STAR-3 and STAR-4 step up to mandatory third-party evaluation, aimed at products headed for government and critical-infrastructure procurement. Per secondary reporting, IPA published STAR-3's concrete requirements on 12 June 2026, initially scoped to two priority categories developed through METI/IPA working groups: network devices (such as routers) and network cameras — the same categories most often named in critical-infrastructure and government-network risk discussions. STAR-4 remained under development as of this guide's research; treat its scope and timeline as unconfirmed until IPA publishes it directly.

IPA began accepting STAR-1 applications on 25 March 2025, a date given on IPA's own page and corroborated independently by METI's official press release announcing the scheme's launch. Secondary reporting adds operational detail IPA's English page does not spell out as plainly: a discounted STAR-1 application fee (110,000 JPY) was available through 30 September 2025, labels are valid for up to two years, and — as of this guide's research — applications must still be submitted in Japanese, meaning a non-Japanese manufacturer needs either in-house Japanese documentation capability or a local partner to apply, not just an English translation of its own security claims.

JC-STAR is not described, in either IPA's or METI's own materials, as a blanket legal product-safety mandate the way the EU's Cyber Resilience Act is for the products it covers. Its practical pull instead comes from government procurement: secondary reporting indicates Japan intends to require JC-STAR labeling in government IoT purchases, starting with STAR-1 and moving toward higher levels as the STAR-2/3/4 requirement sets mature and stabilize. A manufacturer with no interest in Japanese public-sector sales is not confirmed to face a direct legal obligation to hold a label — but the same dynamic that made the UK's PSTI mark and Singapore's CLS label commercially relevant beyond their formal legal scope (retailer and enterprise-buyer preference for labeled products) is a reasonable expectation here too, even though this guide found no data yet confirming that effect for JC-STAR specifically.

The detail most worth tracking going into 2027 is that JC-STAR stopped being a purely domestic scheme in 2026. Per secondary reporting, mutual recognition between JC-STAR and Singapore's CLS began on 1 June 2026, and IPA separately introduced application documentation specifically for products already compliant with the UK's PSTI regime, following direct government-to-government cooperation between Japan and the UK. The same reporting is explicit that these arrangements are meant to reduce duplicate documentation and testing, not eliminate market-specific obligations outright — a manufacturer already holding a PSTI statement of compliance or a Singapore CLS label should confirm exactly what IPA's streamlined JC-STAR path does and doesn't waive before assuming full equivalence, since this guide could not find IPA's own published rules spelling out the precise scope of either recognition arrangement.