Japan IoT Security Requirements for Routers & IP Devices
Japan IoT Security Requirements: MIC Tightens Rules for Routers and IP-Connected Terminal Equipment from April 2027
Japan's Ministry of Internal Affairs and Communications (MIC) has published a significant update to the country's mandatory cybersecurity baseline for network-connected devices. On September 24, 2026, the Official Gazette (Kanpo) carried Ministerial Ordinance No. 111 of 2026, which amends the Terminal Equipment Regulations (Ordinance No. 31 of 1985), together with MIC Notice No. 346 of 2026, which sets out the detailed technical conditions. The revised rules take effect on April 1, 2027.
The amendment is the first major revision of Japan's IoT security baseline since it was introduced in April 2020. It applies to routers and other terminal equipment that use Internet Protocol (IP) and connect directly to a telecommunications carrier's network, and it raises the bar in three areas: software updates, communication interfaces and default credentials.
Regulatory Background
Under Japan's Telecommunications Business Act, terminal equipment that connects directly to a carrier's telecommunications line facilities must comply with the technical standards set in the Terminal Equipment Regulations. Compliance is demonstrated through technical conformity certification, design certification (type certification), connection inspection or self-confirmation, and certified products carry the Japanese technical conformity ("Giteki") mark.
In response to a rise in botnet attacks exploiting poorly secured cameras and routers, MIC added minimum security requirements to Article 34-10 of the Terminal Equipment Regulations through Ordinance No. 12 of 2019, effective April 1, 2020. Those rules required:
an access-control function;
a function prompting users to change the default ID/password, or a unique credential per device;
the ability to update firmware; and
retention of access-control settings and updated software after a power interruption.
Data from Japan's national IoT vulnerability survey (NOTICE, run by NICT) later showed that some devices certified under the 2020 rules were still being detected as exploitable. MIC's ICT Council reviewed the root causes and, on December 8, 2025, issued a partial report recommending stronger requirements, aligned where possible with the voluntary JC-STAR IoT security labelling scheme operated by METI and IPA. Ordinance No. 111 and Notice No. 346 implement that recommendation.
Scope: Which Devices Are Covered
The amended requirements apply to terminal equipment that:
uses Internet Protocol (IP);
connects to digital data transmission facilities (i.e., directly to a carrier's network); and
allows its telecommunications functions to be operated or configured over the network.
Home and office routers are the typical example, but the scope covers any IP terminal equipment meeting these criteria. The same requirements apply to private (self-owned) telecommunications equipment through Article 36 of the Regulations.
Devices that connect only indirectly for example, appliances or cameras sitting behind a router remain outside the mandatory technical standard. MIC has stated it will revisit this question in the future; for now, such products fall under the voluntary JC-STAR scheme.
Key Changes Under the New Japan IoT Security Requirements
1. Software update function: three mandatory capabilities
Previously, Article 34-10 only required that firmware "can be updated." Under Notice No. 346, covered equipment must now provide:
A software update function the ability to update the software that controls telecommunications functions;
A latest-version check a means to confirm that the most recent software version is installed; and
A pre-installation integrity check a mechanism that verifies the integrity of the software program before an update is installed, to prevent tampered or corrupted code from being loaded.
Automatic updates are recommended but not mandatory. During the public consultation, a respondent proposed forcing monthly automatic updates by default; MIC declined, noting that firmware updates may include non-security changes and that applying the latest version is not always appropriate.
2. Interface management: declare every interface and disable unused ones
This is an entirely new requirement the previous rules contained no provision on interfaces. Manufacturers must now:
Identify and disclose every interface on the device together with its intended purpose (and the purpose of each, where there are several); and
Disable any interface not required for the device's operation.
According to the ICT Council materials, "interface" covers not only physical connectors but also logical access points such as communication protocol ports. In practice, this means manufacturers need a documented inventory of all physical ports and network service ports on the device, with every port that is not needed switched off by default. MIC explained that increasingly complex supply chains for components and third-party software can leave communication functions in a device that even the manufacturer is unaware of functions that attackers can exploit.
3. Default credentials: from "prompting" to "forcing" a change
Under the 2020 rules, a device met the standard if it merely prompted users to change the default password. The Council identified three gaps: users could ignore the prompt; there was no minimum strength, so a one-character password technically complied; and some manufacturers shipped simple, guessable default passwords.
Under the amendment, devices must either:
force the user to change the default credential to one that is hard to guess; or
ship with a credential that is unique per device and hard to guess.
Detailed criteria for what counts as "hard to guess" will be set out in MIC's certification guidelines.
Unchanged requirement
Devices must still retain access-control settings and updated software after a power interruption.
Before vs. After: Summary of Article 34-10 Changes
Requirement | Before (2020 rules) | After (from April 1, 2027) |
Default ID/password | Function that prompts a change, or a unique credential per device | Function that forces a change to a hard-to-guess credential, or a unique, hard-to-guess credential per device |
Software updates | Device must be able to update firmware | Three functions required: update capability, latest-version check, and pre-update integrity check (Notice No. 346) |
Interfaces / ports | No requirement | All interfaces and their purposes must be disclosed; unnecessary interfaces must be disabled (new) |
Power interruption | Settings and updated software retained | Unchanged |
Automatic updates | Not required | Recommended, still not required |
Certification Impact Summary
Area | Impact | Details |
Technical standard (Terminal Equipment Regulations) | High | Article 34-10 is revised; new conditions set in MIC Notice No. 346 of 2026 |
Technical conformity / design certification (JATE / Giteki) | High | Applications filed for certification on or after April 1, 2027 must demonstrate compliance with the new requirements |
Existing certificates | None | Equipment certified, design-certified, inspected or self-confirmed before April 1, 2027 may continue under the previous rules |
Assessment method | Moderate | The ICT Council recommended document-based review, with applicants submitting test results and technical evidence rather than mandatory lab testing of physical units by the certification body |
Product design and firmware | High | Secure update architecture (version check, integrity verification) and port/interface hardening must be designed in |
Technical documentation | High | Interface inventory with purposes, update mechanism description and credential policy will be needed for the certification file |
Devices already on the market | None (legal) | No recall or mandatory replacement of installed devices |
Indirectly connected IoT devices | None (for now) | Remain outside the mandatory standard; voluntary JC-STAR labelling applies |
What This Means for Manufacturers
For router, gateway, ONT, modem and other IP terminal equipment manufacturers and for importers placing these products on the Japanese market the amendment turns security good practice into hard certification criteria. The main practical consequences are:
Secure update architecture becomes a certification item. It is no longer enough to offer a firmware download. Devices need a way for users or systems to confirm the installed version is current, and a cryptographic or equivalent integrity check (for example, signature or hash verification) that runs before any update is applied over the network.
Attack surface must be documented and minimised. Engineering teams will need a complete inventory of physical interfaces (USB, serial/UART, Ethernet, debug headers) and logical interfaces (TCP/UDP service ports such as Telnet, SSH, UPnP, TR-069 or web management), each mapped to a stated purpose. Debug ports and legacy services left enabled by default including those inherited from chipset SDKs or third-party software are now a compliance risk, not just a security risk.
Default password strategy may need redesign. Products that rely on a shared default password plus an on-screen reminder will not meet the new rules. Manufacturers should move to unique per-device credentials or a mandatory first-use password change with strength rules, and follow MIC's forthcoming guideline on what qualifies as "hard to guess."
Certification timing matters. Because products certified before April 1, 2027 may continue under the previous rules, manufacturers with models in development should assess whether to complete certification before the enforcement date or design to the new requirements now. Any certification filed on or after April 1, 2027 including new models and, potentially, modified versions of existing ones must meet the new standard.
Alignment with global regimes. The new requirements move Japan closer to the EU Cyber Resilience Act, the UK PSTI regime and ETSI EN 303 645. Manufacturers already working to these frameworks or to JC-STAR Level 1 will find substantial overlap, and can reuse much of their existing security evidence for Japanese certification.
Timeline
Date | Milestone |
April 1, 2020 | Original IoT security requirements (Article 34-10) take effect |
December 8, 2025 | ICT Council issues partial report recommending revision of terminal security standards |
April 24, 2026 | MIC refers the draft amendment to the Information and Communications Administration Council (Referral No. 3215) |
April 25 – May 29, 2026 | Public consultation on draft ordinance and notice (5 comments received) |
July 28, 2026 | Council report confirms the amendment as appropriate; MIC publishes consultation results |
September 24, 2026 | Ordinance No. 111 of 2026 and MIC Notice No. 346 of 2026 promulgated in the Official Gazette |
Before April 1, 2027 | Window to certify products under the previous rules |
April 1, 2027 | New requirements take effect for all new certifications |
Required Actions for Manufacturers
Priority | Action | Target date |
1 | Identify all products in the Japanese portfolio that are IP terminal equipment connecting directly to carrier networks | Q4 2026 |
2 | Run a gap assessment of each product against the three update functions, interface requirements and new credential rules | Q4 2026 |
3 | Decide on certification strategy: certify pending models under the current rules before April 1, 2027, or design to the new standard | Q4 2026 |
4 | Implement a latest-version check and a pre-update integrity verification mechanism in firmware | Q1 2027 |
5 | Build an interface and port inventory with stated purposes; disable all unnecessary physical and logical interfaces by default | Q1 2027 |
6 | Replace shared default passwords with unique per-device credentials or a forced first-use change meeting strength criteria | Q1 2027 |
7 | Update technical documentation and test evidence for the certification file; monitor MIC guideline updates on the new criteria | Before filing |
8 | Coordinate with your registered certification body (e.g., JATE or another MIC-registered body) on evidence expected under document-based review | Before filing |
Conclusion
Ordinance No. 111 of 2026 marks a clear step up in Japan IoT security requirements. From April 1, 2027, routers and other directly connected IP devices will need verifiable, integrity-checked software updates, a documented and hardened set of interfaces, and default credentials that users cannot leave weak. While existing certificates are protected by a transitional provision, manufacturers planning new products for Japan should start aligning firmware, hardware configuration and documentation now to avoid certification delays after the enforcement date.
