The Ministry of Economy, Trade and Industry has put a draft revision of its Cyber/Physical Security Framework (CPSF), version 1.1, out for public comment. Submissions must arrive by Monday, December 21, 2026, Japan time, after the draft opened on October 23.
CPSF is a reference framework, not a new law. The e-Gov notice lists no statutory basis and describes the consultation as a voluntary one, not a procedure under the Administrative Procedure Act.
What the draft changes
METI issued version 1.0 on April 18, 2019. The draft's revision history says that after about seven years some requirements and measure examples no longer reflect current security trends. This round therefore concentrates on Part III, the requirements and measure examples, and on the appendices, rebuilt around the latest major standards. METI's consultation outline says the revision gives particular weight to international developments including NIST Cybersecurity Framework 2.0.
Part III now sorts requirements into six functions: govern, identify, protect, detect, respond and recover. Appendix D maps them to NIST CSF 2.0 subcategories, to NIST SP 800-171 Rev.3 requirements and to the ISO/IEC 27001:2022 Annex A controls. Appendix C ties its measure examples to NIST SP 800-53 Rev.5 Release 5.2.0, ISO/IEC 27001:2022 and the IEC 62443-2-1:2024 and IEC 62443-3-3:2013 standards. Appendix D's 800-171 table cites Release 5.1.1 of SP 800-53, so readers cross-checking the two appendices will meet two release numbers.
What suppliers should check
The draft invites buyers to hold trading partners to specific requirements. It names CPS.GV.SC-01, SC-05 to SC-11 and related items in the supply-chain risk management category as the process for doing so, and says the aim is governance across the life of a contract. Appendix C gives measure examples at three levels: Basic, Advanced and High-Advanced. A High-Advanced example under CPS.GV.SC-05 has buyers obliging suppliers by contract to supply and maintain component inventories, such as a software bill of materials, for important products.
Appendix C says its examples are illustrations, and that other implementations can satisfy a requirement. A supplier whose customers cite CPSF in contracts will still want to compare the draft's levels and mappings with its current controls.
What is deferred
The draft does not address AI-related risk. METI says it plans to consider further revisions from the next fiscal year, in light of AI use and threat trends. The draft's revision history says the AI work will follow the state of international frameworks.
How to comment
Comments can go through the e-Gov submission form, whose instructions are in Japanese only, in Japanese or English. Alternatively, a form can be emailed to [email protected]. METI says it will not reply to individual comments, and submissions may be published with personal details removed. The version 1.1 revision date in the draft is still a placeholder.