Quick Cut 009｜データセンター・クラウド安全認証——中国系排除で本当に安全になるのか｜Does Excluding China Make the Cloud Safe?
Does Excluding China Make the Cloud Safe? Japan reportedly plans to introduce a national security certification for data centers and cloud services from fiscal 2027
Does Excluding China Make the Cloud Safe?
Japan reportedly plans to introduce a national security certification for data centers and cloud services from fiscal 2027 onward. Financial institutions, healthcare providers and other users of sensitive personal data would be encouraged to choose certified services. The headline effect is clear: providers exposed to Chinese or Russian state authority may find certification effectively unattainable.[1]
My conclusion is supportive but conditional. A certification regime is justified because cloud risk is no longer limited to technical vulnerabilities. It includes foreign legal compulsion, remote administrator access, opaque subcontractors, control of encryption keys, hardware and software supply chains, and the ability to restore services during a geopolitical or cyber crisis. Japan’s own economic-security discussions have already described data centers and cloud services as infrastructure processing and storing vast amounts of data.[2]
But excluding Chinese providers does not, by itself, make a system secure. A Japanese provider can be badly governed. A US provider can remain exposed to extraterritorial legal demands. A certified platform can still fail through misconfiguration by its customer. Nationality is therefore a risk signal, not a complete security test.
The correct test should ask five questions:
- Control: Who holds administrator privileges, and from where can they be exercised?
- Jurisdiction: Which governments can legally compel the provider or its parent company to disclose data?
- Keys: Can the customer retain exclusive control of encryption keys?
- Continuity: Can operations and recovery continue inside Japan if overseas support is interrupted?
- Exit: Can data and workloads be moved to another provider without prohibitive cost or delay?
Japan should apply these tests symmetrically. The government already uses ISMAP for public-cloud procurement, while AWS, Google Cloud, Microsoft Azure and Oracle Cloud are in use and Sakura Cloud has been selected conditionally.[3] The new certification should complement—not duplicate—ISMAP, SCS, ISO 27017 and sector rules.
Likely market impact
The largest opportunity is not an immediate migration from Chinese clouds. Their share of Japan’s most sensitive regulated workloads is likely already limited. The real market may be created by compliance work: sovereign-cloud configurations, domestic operations, identity and access management, customer-controlled keys, audit, backup, migration and continuous monitoring.
Domestic providers and integrators such as IIJ, Sakura Internet, NTT Group, KDDI, SCSK, NEC and Fujitsu could benefit if the rules create measurable demand. Yet certification is not earnings. Investors must still verify mandatory scope, pricing power, incremental contracts, required capital expenditure and margins. US hyperscalers may also qualify through stronger Japanese operational controls, so “foreign cloud out, domestic cloud in” is too crude an investment thesis.
The failure modes
- A nationality shortcut that ignores weak governance at approved domestic providers.
- A static checklist that is obsolete soon after certification.
- Higher prices and weaker functionality from an overly narrow approved list.
- Concentration risk: too many critical systems on a small number of certified platforms.
- Duplicate audits across ISMAP, SCS and sector-specific rules.
- Certification being misunderstood as a guarantee, even though customer configuration remains part of security.
Final judgment
Japan should certify controllability, not patriotism. If the regime continuously tests legal exposure, privileged access, key custody, resilience and portability, it is good economic-security policy. If it simply turns “not Chinese” into a safety label, it will be expensive theater.
