Japan to Launch Government-Backed Certification for Data Centers and Cloud Services to Bolster Security Against China, Russia Risks

Japan is preparing to introduce a government-backed certification program for data centers and cloud computing services, a move designed to steer critical industries toward more secure digital infrastructure and reduce exposure to security threats linked to countries such as China and Russia, Nikkei has learned.

The planned framework would rate and formally certify facilities and services that meet Japan’s security expectations, with a particular focus on sectors where outages or data breaches could have outsized consequences. Finance and healthcare are expected to be among the priority areas Tokyo wants to guide toward approved providers.

Under the envisioned system, data centers—large-scale facilities that house servers and storage used to run online services—would be evaluated across multiple dimensions tied to security and resilience. One key area will be how operators manage risk, including internal controls and protections against cyberattacks or unauthorized access. Another will be supply-chain integrity: authorities intend to examine where critical equipment is sourced and whether procurement practices could introduce vulnerabilities. Similar scrutiny is expected for cloud services, which deliver computing power and data storage over the internet and have become foundational to banks, insurers, hospitals, and a broad range of enterprises.

The policy push reflects Japan’s growing concern that dependence on technologies, components, or services tied to “countries of concern” could create openings for espionage, sabotage, or coercion during diplomatic or military crises. By defining what “secure” looks like and creating an official label for qualifying services, Japan aims to make it easier for organizations handling sensitive information—such as financial transaction data or medical records—to select providers that meet a consistent standard.

A certification approach also signals a shift from relying mainly on voluntary best practices to using a structured mechanism that can influence procurement decisions across both the public and private sectors. If widely adopted, the program could shape which providers win contracts and where companies place critical workloads, as firms seek to satisfy regulators and reassure customers.

Japan’s data center market includes major domestic operators, such as Fujitsu, whose facilities exemplify the type of infrastructure likely to be assessed under the new criteria. Details of implementation, including the specific benchmarks and how certification will be maintained over time, have not been disclosed in the information reported so far.

Why it matters

Financial institutions, hospitals, and other essential services increasingly depend on cloud and data-center infrastructure, making security and supply-chain integrity central to national resilience. A formal certification system could quickly become a de facto requirement for winning business in regulated industries, potentially reshaping competition among providers and vendors. The next key questions are how strict the standards will be and whether the program will meaningfully reduce reliance on technology linked to higher-risk jurisdictions.