A Manga Guide to Company Security “Stars”: Japan’s SCS Rating Scheme (for Young Readers)

Also published on Site Scouter.

A letter arrived at Mio’s grandpa’s factory from a big company: “Please get ★3 by next year.” Stars? Like hotel stars? Mio, a primary school girl, and her clever friends Souta and Haruka find out what the security stars for companies are all about. They are the same three friends as in the manga “The shop’s front door and back door”.

6 episodes, 18 panels. Under each episode, the same story is also written out in text. When you have finished, please also look at “For parents and teachers” below. The stars are a real scheme: its details were published in October 2026 by IPA (the Information-technology Promotion Agency, Japan), a government agency.

1. Episode 1: Please get a star?

Grandpa (in the factory office, looking at a letter, worried): “Three stars…?” Mio: “Grandpa, what’s wrong?”
Grandpa (showing the letter): “It’s a letter from an important customer. It says, ‘Please get ★3 by next year.'” Mio: “Stars? Like hotel stars?”
Haruka (arriving with Souta): “No. It’s a star for a company’s ‘power to protect’. I’ll tell you all about it.” Souta: “I looked it up too!”

2. Episode 2: What is a supply chain?

Haruka (pointing at a whiteboard drawing of a factory → a car → a shop): “Grandpa’s factory makes screws and sends them to a car company. Companies are linked together like a chain. That’s a ‘supply chain’.”
Souta (pointing at a person in a black hood creeping up to a factory at night): “Big companies are well protected. So bad people try to sneak in through a small factory instead.”
Mio (shocked): “What? They might go after Grandpa’s factory?!” Haruka: “That’s why the government made the star scheme, so that everyone protects each other.”

3. Episode 3: What do the stars mean?

Haruka (pointing at a three-step stand): “There are three levels: ★3, ★4 and ★5. Everyone starts with ★3.”
Souta (unrolling a long scroll): “★3 has 26 ‘promises’. For example…” Mio: “26?!”
Haruka: “① Make passwords long, and never reuse them ② Install updates within 14 days ③ Keep a copy of important data in another place too ④ Decide who to call when there’s trouble” Mio: “That’s like the ‘internet promises’ we learned at school!”

4. Episode 4: Who gives out the stars?

Haruka (Grandpa is ticking a checklist): “First, you tick the checklist yourselves.”
Souta (an expert is pressing a stamp): “When a ‘security expert’ registered with the government checks it and says ‘OK’, the company president declares ‘we really are protected’ and registers with IPA. ★3 achieved!”
Mio: “What about ★4?” Haruka (checking the factory door lock with a magnifying glass): “For ★4, an inspector checks the factory’s internet entrance from outside. Like making sure the door lock isn’t broken.”

5. Episode 5: Money and time

Grandpa (holding a coin): “Does it cost money?” Souta: “What you pay IPA for ★3 is ¥10,000 a year. But paying the expert and replacing old computers costs extra. And it takes a few months.”
Mio (holding a calendar): “When can you apply?” Haruka: “From March 2027! So starting to prepare now is just right.”
Haruka (raising her hand to a salesman holding a sign): “Watch out for salespeople who rush you, saying ‘get a star right now or you’ll lose your business’. The government has warned about them.” Mio: “I see!”

6. Episode 6: Grandpa’s factory

Grandpa (pointing at the office computers): “First, let’s count how many computers we have in the office.” Mio: “I’ll help!”
Mio (pointing at a sticky note on the monitor): “A password of ‘1234’ is no good, Grandpa!” Grandpa: “Oops!”
A few months later. A gold star hangs on the wall. Customer (bowing): “Thank you. Now we can work with you with peace of mind.” Haruka: “A star means ‘we really are protected’. If everyone protects each other, the chain won’t break!” Mio: “The end!”

7. For parents and teachers

The scheme in this manga is real. Its official name is the “Security Rating Scheme for Strengthening Supply Chains” (the SCS rating scheme), and IPA runs it under the supervision of Japan’s Ministry of Economy, Trade and Industry and the Cabinet Secretariat. The assessment guides and the handbook were published on 28 October 2026, and applications for ★3 and ★4 are scheduled to open in March 2027.

Here are the points the manga leaves out:

There are three levels, ★3, ★4 and ★5; there is no ★1 or ★2. ★5 is still under study
★3 has 26 requirements and ★4 has 43. For ★3, an expert registered with the government confirms the company’s own check; for ★4, the company is audited by an assessment body and receives an external vulnerability scan (the “door lock” in episode 4)
The registration fee is ¥10,000 per year for ★3 (until the end of March 2028; ¥20,000 after that) and ¥60,000 for 3 years for ★4. Fees paid to experts and assessment bodies are separate
The demand for stars cascades down to tier-3 suppliers. A company that obtains ★4 is obliged to know its suppliers’ security status (requirement 2-1-3), so, like Mio’s grandpa’s factory in the manga, companies that do not deal directly with large companies are asked for stars too. Once a customer writes stars into its procurement standards, companies without one are not chosen as suppliers
Legally, the scheme is voluntary, and IPA says that “not having a star does not mean business is stopped immediately”. Whether to make it a business condition is decided between the companies in their contract. Japan’s Ministry of Economy, Trade and Industry and the Cabinet Secretariat have warned against inappropriate sales pitches that rush companies by saying “get one right now or you will lose your business”
The four promises in episode 3 were chosen from the actual requirements: passwords of at least 8 characters (at least 10 without two-step verification or lockout), serious updates applied within 14 days of release, an off-site backup of important data, and a decided contact list and procedure for incidents

When explaining this to children, it helps to describe it as the “company version” of the internet rules they learn at school, such as “lock the door”, “don’t tell strangers your password” and “don’t open strange emails”.

For a detailed explanation for adults, see the general guide; for settings and procedures, the guide for engineers; and if you run a company, the guide for executives.

8. Method notes and limits

The characters and companies in the manga are fictional. The description of the scheme is based on IPA’s scheme website, FAQ, requirements and evaluation criteria (SCS-400 Ver.1.1), handbook and fee notice, as published on 30 October 2026. The language has been simplified for children, so please check the primary documents for exact definitions. We have written separate articles for different readers, so please also see the articles for engineers, for general readers and for executives.

Can anyone get a star? Stars are for companies and organisations, of any industry or size.

What is good about getting a star? It shows customers that “we really are protected”. Companies with a star are listed on IPA’s website and can use the logo mark.

What happens if a company doesn’t get one? There is no legal penalty. But if a customer decides to “only do business with companies that have a star”, companies without one will not be chosen.

When will ★5 start? It has not been decided yet. IPA has announced that it will study it further.

Sources

IPA: Security Rating Scheme for Strengthening Supply Chains (SCS rating scheme): https://www.ipa.go.jp/security/scs/index.html
IPA: Frequently asked questions: https://www.ipa.go.jp/security/scs/faq.html
IPA: Requirements, evaluation criteria and assessment guides: https://www.ipa.go.jp/security/scs/requirements-criteria.html
IPA: Fee notice (2026-09-18, PDF): https://www.ipa.go.jp/security/scs/rcu1hd00000075om-att/pricelist.pdf
METI: SCS rating scheme special site: https://www.meti.go.jp/policy/netsecurity/scs.html