Japan’s METI and IPA launched JC-STAR, a voluntary multi-level IoT product security labeling scheme. STAR-1 provides baseline criteria, while higher levels ar
Official source publication date: . AndroidSBC review date: 2026-10-26.
How does Japan’s JC-STAR scheme work?
Japan’s Ministry of Economy, Trade and Industry and the Information-technology Promotion Agency launched JC-STAR on 25 March 2025 to make IoT product security information easier for purchasers to evaluate.
Key points from the official publication
- The scheme covers a broad range of IP-connected IoT products, including products that connect indirectly to the Internet, while the official description identifies exclusions such as PCs and smartphones.
- STAR-1 is a common baseline addressing minimum threats across covered IoT products.
- The published design describes higher STAR levels for product-category requirements and stronger evaluation, including third-party laboratory evaluation for the highest levels.
- A granted label can include a QR code linking to an IPA-managed product page with vendor, product, label, update, vulnerability and contact information.
- METI stated an intention to develop higher-level criteria and pursue international interoperability and mutual recognition.
Practical actions for an Android product project
- Identify whether the finished product falls within the current JC-STAR scope and level.
- Maintain versioned security, update, vulnerability and support information.
- Ensure the applicant, model, firmware and product configuration match the submitted evidence.
- Check the latest IPA requirements and procurement rules before relying on a label in a tender.
What does this mean for Android board and embedded-device projects?
Android device projects should record supported software, update and vulnerability processes, network services, credentials and configuration. Determine whether the finished Internet-connected product falls within the scheme and match any application to the exact product, version and published evidence.
What should buyers and engineering teams verify?
- The exact board, PCB revision, SoC, BSP branch, kernel and Android build.
- The finished product’s intended use, wireless modules, enclosure and destination market.
- Security-update ownership, vulnerability contact, support period and incident process.
- Which controlled report, declaration or certificate applies to the exact configuration.
This article is an engineering summary, not legal or conformity-assessment advice. Requirements can change; confirm the current official text and obtain qualified local advice for the finished product.
Buyer FAQ
Common procurement and engineering questions related to this update are answered below. Project decisions must use the current official requirements and the exact product configuration.
Does JC-STAR cover all Android-based products?
No. Confirm the current scheme scope, exclusions, product category and target STAR level for the finished connected product. Product type and deployment context matter.
What records help support a JC-STAR project?
Maintain exact model and firmware identifiers, supported update period, vulnerability contact, network-service inventory, credential behavior, security configuration and evidence matching the submitted product.
Does a label for one model cover another board or firmware version?
No assumption should be made. Check the registered product information, validity, configuration and change-control rules. Hardware or software changes may require review or a new application.
Official primary source
Primary source
Japan Ministry of Economy, Trade and Industry
Read the original official publication
Source URL: https://www.meti.go.jp/english/press/2025/0325_006.html
Editorial note: This is an original AndroidSBC engineering summary of the cited official publication. It is not legal advice and does not claim that every Android board or finished device is certified for the named market.
