Security AuditSecurity Audit

SCS Assessment Scheme ★3 & ★4 / NIST SP 800-171 / Customer Framework Audits

We review policies, evidence, technical configurations, and supplier management practices to deliver an audit report and improvement roadmap that you can confidently present to your customers.

Proposal Summary

Our evidence-based security audit service supports supply-chain requirements, NIST standards, and customer-specific criteria.

Purpose of a Security Audit

We turn assumed security measures into a defensible, evidence-backed position that can be explained to customers, management, and assessors.

Scope

SCS Assessment Scheme ★3 and ★4, NIST SP 800-171, customer-specific checklists, NIST CSF, CIS, ISO, SOC 2, and more.

Deliverables

Audit report, gap register, evidence register, risk assessment, improvement roadmap, and presentation materials.

Approach

Criteria definition → evidence collection → document review → interviews/on-site verification → risk assessment → findings presentation.

Service Positioning

We provide audit preparation, mock audits, evidence development, and improvement support—not the official assessment performed by a designated assessment body under the applicable scheme.

Why Security Audits Are Essential Now

IPA's 10 Major Security Threats 2026 ranks ransomware, supply-chain and supplier risks, risks associated with AI use, and vulnerability exploitation among the leading issues that directly affect business continuity.

Priority Audit Themes Based on IPA's 10 Major Security Threats 2026 for Organizations

Priority Audit Areas

We assess ransomware defenses, supplier management, vulnerability management, log monitoring, incident response, and governance of AI use in connection with policies, roles, operational evidence, and continual improvement—not as isolated technical controls.

Challenges Addressed by Security Audits

Traditional audits that merely involve completing a checklist often fail to provide an accurate view of actual practices, clear improvement priorities, or persuasive explanations for customers.

Common Challenges and Our Audit-Based Solutions

• Security education and training are ad hoc, making their effectiveness difficult to demonstrate.
• Audit records are maintained only as a formality for ISO 27001 or PrivacyMark certification and do not adequately address supply-chain requirements.
• Without an information security management function or CISO support, responses to customer requests depend on individual personnel.
• Security levels across the company, group companies, and suppliers cannot be compared and managed using common criteria.

Service Overview

We translate the SCS Assessment Scheme, NIST SP 800-171, and customer-specific criteria into audit items and evidence registers that can be verified in actual operations.

Service Portfolio

We combine scheme readiness, compliance reviews, customer audits, and technical verification according to the scope you require.

1. 1SCS ★3 Expert Review Support

   Preparation for self-assessment, evidence registers, management declarations, and expert review.

2. 2SCS ★4 Mock Audit and Technical Verification Readiness

   Gap analysis, evidence organization, and remediation support in preparation for third-party assessment and technical verification.

3. 3NIST SP 800-171 Compliance Review

   Assessment of CUI scope, SSP, PoA&M, and control implementation using Examine, Interview, and Test methods.

4. 4Custom Customer Framework Audit

   Mapping to requirements from NIST CSF, CIS Controls, ISO 27001, SOC 2, and other frameworks.

Delivery Policy

When a customer specifies a reporting format, we organize the audit results accordingly. If no format is specified, we use our standard checklist, evidence register, and improvement plan templates.

Audit Scope

Our security audits cover not only IT systems, but also related assets, business processes, suppliers, and operational evidence.

Audit Scope Across the Organization, Operations, IT, and Suppliers

Security audits assess information assets, business processes, operational evidence, and supply-chain management as an integrated whole—not technology alone.

Area	Key Review Items	Examples of Evidence
Organization and Governance	Accountability, division of roles, risk acceptance, management review	Organization charts, committee minutes, risk register
Policies and Procedures	Information classification, access management, supplier management, exception management	Policies, procedures, exception approval records
Technical Operations	Identity management, logging, vulnerabilities, backups, endpoint management	Configuration screens, logs, tickets, assessment results
Supplier Management	Contracts, SLAs, subcontracting, incident notification, periodic assessments	Contracts, questionnaires, assessment results, remediation records

Supported Audit Criteria

Even when customers specify multiple standards, we reuse evidence across common control areas to reduce duplicated audit work.

Mapping to Major Frameworks

We map customer checklists to common control areas, identifying both coverage gaps and overlapping requirements.

Key Point

Evidence can be reused even when the standards differ.
Examples: access review records, retained logs, supplier assessments, and incident exercise records.

• NIST CSF 2.0: A comprehensive view of governance, operations, and technology based on Govern / Identify / Protect / Detect / Respond / Recover.
• CIS Controls v8.1: Practical cyberattack defenses assessed against high-priority implementation safeguards.
• ISO 27001 / SOC 2 / CSA CCM / ISMAP / industry-specific checklists: Audit items customized to customer requirements.

SCS Assessment Scheme ★3 and ★4 Audit Support

As of July 2026, IPA is continuing to publish and refine the details of the scheme. Based on publicly available information, we provide readiness assistance, evidence development, mock audits, and improvement support.

Support for SCS Assessment Scheme ★3 and ★4

According to information published by IPA, ★3 is expected to involve a self-assessment reviewed by an expert, while ★4 is expected to involve third-party assessment and technical verification. We help prepare audit-ready evidence and conduct mock audits for the application and assessment process.

Our Support

Requirements interpretation / gap analysis / evidence register / mock audit / technical verification readiness / remediation plan / findings presentation

Level	Published Assessment Scheme	Our Support
★3	A self-assessment reviewed by a security expert and submitted to the secretariat together with a management declaration of conformity.	Requirements interpretation, self-assessment review, evidence register development, management briefing, and pre-submission review.
★4	Third-party assessment and technical verification by an assessment body, followed by a registration application to the secretariat using the assessment report.	Mock audit, technical verification readiness, evidence review, improvement planning, and preparation of Q&A for the assessment body.

NIST SP 800-171 Compliance Review

Based on contractual and customer requirements, we assess against Rev. 2 or Rev. 3 and review the CUI scope, SSP, PoA&M, and control implementation status.

NIST SP 800-171 Compliance Review

For systems and organizations that handle CUI, we verify implementation through documentation, interviews, and testing based on the principles of NIST SP 800-171 and 800-171A.

1. 1Define CUI Scope

   Identify the information, systems, and suppliers in scope

2. 2Review SSP

   Review the System Security Plan

3. 3Assess Controls

   Verify implementation across all 17 control families

4. 4Verify Evidence

   Cross-check documents, logs, screens, and tickets

5. 5PoA&M

   Develop an improvement plan for outstanding items

Assessment Methods: Examine / Interview / Test

Examine

Review documents, configurations, logs, contracts, tickets, and other evidence

Interview

Interview management, the CISO, IT personnel, and business personnel about actual operations

Test

Validate samples, access rights, logs, backups, and configuration values in practice

Review
Approach

NIST SP 800-171A defines assessment procedures and methodologies that can be tailored to the required depth and scope. Our service applies the Examine, Interview, and Test methods to verify that implementation status is consistent with the supporting evidence.

Customer Framework Audits

Based on the cybersecurity framework adopted by your customer, we design audit items, evidence requirements, assessment criteria, and response language.

Custom Audits Based on Customer Frameworks

Even when a customer uses a proprietary checklist, international standard, or cloud assessment framework, we translate its requirements into audit items and perform the review.

For Customers

Design supplier assessment checklists, review responses, audit critical suppliers, and assign risk ratings.

For Suppliers

Support responses to customer requirements, prepare evidence packages and improvement plans, and conduct pre-audit rehearsals.

For Group Companies

Conduct common audits across domestic and overseas locations, identify location-specific gaps, compare maturity, and design improvement KPIs.

For Cloud/SaaS Providers

Verify cloud-specific shared responsibilities and evidence using CSA CCM, SOC 2, ISMAP, ISO 27017, and other frameworks as references.

Audit Methodology and Assessment Criteria

Our audits verify not only whether documentation exists, but also whether controls are operating, supported by evidence, and continually improved.

Audit Methodology: Evidence-Based Maturity Assessment

Through sampling and evidence reconciliation, we verify not only documented arrangements but also whether they are operating effectively in practice.

Rating	Meaning	Example
Conforming	The requirement is met and supporting evidence is available.	Access rights are reviewed periodically and approval records are retained.
Partially Conforming	A process exists, but its scope, evidence, or frequency is insufficient.	Logs are retained only for some systems, or SaaS is excluded from inventories.
Nonconforming	Processes or evidence required by the requirement are missing.	No supplier assessment records exist, or access rights have not been reviewed.
Observation	Not an immediate nonconformity, but improvement is recommended.	Policy terminology is outdated, or exception management depends on specific individuals.

Process from Initiation to Reporting

By clarifying the audit objective and intended recipients and organizing the required evidence and responsible personnel in advance, we deliver an effective audit within a short timeframe.

Service Process

We tailor the engagement to your objectives and scope, from a streamlined assessment completed in as little as 2–4 weeks to a comprehensive audit lasting 8–12 weeks.

1. 1Kickoff

   Agree on objectives, criteria, scope, and project structure

2. 2Requirements Definition

   Convert SCS, NIST, and customer requirements into audit items

3. 3Evidence Collection

   Collect policies, logs, configurations, contracts, and tickets

4. 4Interviews and Verification

   Verify actual operations and selected samples

5. 5Gap Assessment

   Determine criticality, risk, and remediation difficulty

6. 6Findings and Improvement Plan

   Present the report, evidence register, and roadmap

We define the evidence and responsible personnel for each phase, reducing dependence on individual staff and preventing duplicated audit work.

Typical Duration

Approximately 2–4 weeks for a light assessment, 4–6 weeks for SCS ★3 support, 6–10 weeks for a NIST SP 800-171 review, and 8–12 weeks for SCS ★4 or a comprehensive customer audit.

Deliverables

We deliver audit results in reusable formats suitable for customer submissions, management reporting, future audits, and continual improvement.

A Defensible Package for Customers, Management, and Assessors

Rather than providing a simple list of findings, we deliver a practical package that links evidence, risks, and improvement plans.

• Audit report: Overall assessment, critical risks, ratings, rationale, and management summary.
• Audit checklist: Requirements, ratings, comments, evidence links, owners, and deadlines.
• Evidence register: Available evidence, missing evidence, update frequency, and responsible owners.
• Improvement roadmap: Priorities, implementation sequence, required resources, and completion criteria.

Visualizing Audit Results

We provide both quantitative and qualitative visualizations so management, IT, and business departments can share a common understanding and work together on improvements.

Example Assessment Visualizations

Findings are visualized not merely as counts, but in terms of risk, evidence gaps, improvement priorities, and maturity by area.

For each finding, the report links the requirement, current state, rationale, risk, recommended action, responsible owner, and deadline.

For Management

A 1–2 page summary of critical risks, business impacts, and information needed for budget and staffing decisions.

For Operational Teams

A traceable list covering requirements, evidence, remediation deadlines, and responsible personnel.

For Customers

Submission-ready response language, supporting documentation, and explanations of planned improvements.

For Future Audits

An evidence register and improvement history that reduce preparation effort for the next audit.

Post-Audit Follow-Up

We ensure that identified gaps are not left unresolved by organizing improvements into short-term remediation, medium-term development, and continual improvement initiatives.

Example Post-Audit Improvement Roadmap

Based on the audit results, we distinguish items requiring immediate remediation from those that should be systematized over the medium to long term.

• Days 0–30Immediate Remediation of Critical Risks

  • MFA and access review
  • Backup verification
  • Strengthen customer responses

• Days 31–60Develop Operational Evidence

  • Log retention procedures
  • Supplier register
  • Training records

• Days 61–90Scheme and Audit Readiness

  • SCS/NIST evidence register
  • Management review
  • Mock audit

• After Day 90Continual Improvement and Automation

  • Regular KPI reviews
  • Monitoring and vulnerability management
  • Reassessment

The improvement plan defines who is responsible, the deadline, and the evidence required to demonstrate completion, which we verify through a follow-up audit.

• Address critical risks immediately: MFA, public exposure settings, backups, vulnerabilities, privileged identities, log retention, and more.
• Maintain scheme-ready evidence: Keep submission-ready support for SCS, NIST, and customer requirements in an evidence register.
• Verify implementation through reassessment: Confirm evidence of completed remediation and organize residual risks and next-phase actions.

Additional Options

Depending on the issues identified during the audit, we can combine technical verification, education, training, policy revisions, SOC 2 readiness, and other services.

Optional Services

Based on the audit results, you can add the technical verification, education, training, and policy development services you require.

Add only the services you need, keeping the engagement focused directly on your audit objectives without unnecessary consulting.

Positioning Regarding SOC Reports

This service does not issue SOC 2 or other assurance reports. It provides readiness assessments, evidence development, and control design reviews for SOC 2, ISAE 3000, and supplier control assessments.

Pricing Plans

We provide an individual quote based on the audit objectives, scope, number of systems, volume of evidence, and whether on-site work is required.

Sample Pricing Plans

Pricing depends on the scope, number of locations and systems, volume of evidence, and whether on-site work is required. The following figures are estimates.

• Light Assessment

  Estimated Price

  From ¥300,000

  Duration

  2–4 weeks

  Review of key documents, brief interviews, and identification of critical gaps

• SCS ★3 Support

  Estimated Price

  From ¥500,000

  Duration

  4–6 weeks

  Self-assessment, evidence register, expert review, and pre-submission review

• NIST Review

  Estimated Price

  From ¥900,000

  Duration

  6–10 weeks

  CUI scope, SSP/PoA&M, control review, and findings presentation

• SCS ★4 / Customer Audit

  Estimated Price

  From ¥1,200,000

  Duration

  8–12 weeks

  Mock audit, technical verification readiness, assessment body support, and improvement planning

* A formal quote will be provided following a free consultation.
* Prices exclude tax. Vulnerability assessments, on-site audits, overseas locations, English-language reports, official assessments as an assessment body, and other additional services are quoted separately.

Pricing Factor	Considerations
Scope	Number of locations, departments, systems, cloud/SaaS services, and suppliers.
Audit Criteria	SCS, NIST SP 800-171, NIST CSF, CIS Controls, ISO/SOC 2, and customer-specific formats.
Volume of Evidence	Organization and availability of existing documents, logs, configuration screens, tickets, and contracts.
Verification Method	Remote or on-site work, technical verification, English-language support, and number of findings presentations.

Frequently Asked Questions

During the initial consultation, we confirm the audit objective, intended recipient, criteria, deadline, and scope, then recommend the most efficient approach.

We received a proprietary checklist from a customer. Can you support us?

Yes. We classify the requirements by control area and distinguish items that can be answered using existing evidence from those requiring additional action.

Can you help us obtain SCS Assessment Scheme ★4?

Official third-party assessments and technical verification are expected to be performed by designated assessment bodies and technical verification providers under the scheme. We provide pre-assessment mock audits, evidence development, remediation support, and preparation for working with the assessment body.

Do you assess NIST SP 800-171 against Rev. 2 or Rev. 3?

We follow the applicable contract terms and customer requirements. We can support continued compliance with Rev. 2 or conduct a proactive gap assessment against Rev. 3.

Can a vulnerability assessment be included in the audit?

Yes, it can be added as an optional service. During the audit, we also verify whether the assessment results are reflected in the risk assessment, remediation plan, and supporting evidence.

Can the audit report be submitted to our customer?

Yes. We can prepare separate customer-facing and detailed internal versions based on the recipient's format and the applicable confidentiality boundaries.

References and Contact Information

This service information has been prepared based on publicly available information as of July 8, 2026.

References

Category	Document	URL
SCS Assessment Scheme	IPA: “Security Measures Assessment Scheme for Strengthening Supply Chains (SCS Assessment Scheme)”	https://www.ipa.go.jp/security/scs/index.html
SCS Assessment Scheme	IPA: “Detailed Information on the SCS Assessment Scheme”	https://www.ipa.go.jp/security/scs/details.html
Threat Intelligence	IPA: “10 Major Security Threats 2026”	https://www.ipa.go.jp/security/10threats/10threats2026.html
NIST	NIST SP 800-171 Rev.3	https://csrc.nist.gov/pubs/sp/800/171/r3/final
NIST	NIST SP 800-171A Rev.3	https://csrc.nist.gov/pubs/sp/800/171/a/r3/final
NIST	The NIST Cybersecurity Framework 2.0	https://www.nist.gov/cyberframework
CIS	CIS Critical Security Controls Version 8.1	https://www.cisecurity.org/controls/v8-1
Management Guidelines	Ministry of Economy, Trade and Industry: “Cybersecurity Management Guidelines Ver. 3.0”	https://www.meti.go.jp/policy/netsecurity/mng_guide.html