HIXORSECURITY ACTION One Star and Two Stars: How to Declare and What to Prepare
"Please complete a SECURITY ACTION declaration" — many companies first see this phrase in a subsidy notice or a message from a business partner. This article explains the difference between one star and two stars, the concrete steps to a declaration, and the points where many companies stumble. (SECURITY ACTION is a Japanese programme for businesses in Japan; this English version is a faithful summary of the Japanese guide.)
- Applying for the Digitalization / AI Adoption Subsidy requires a G Biz ID Prime account and a SECURITY ACTION declaration at either the one-star or two-star level.
- For two stars, you apply only after completing the self-assessment and publishing your information security policy. The order matters.
- There is no minimum score on the self-assessment. The score is not a pass/fail judgement — it shows you where your weak points are.
SECURITY ACTION is a programme run by IPA (the Information-technology Promotion Agency, Japan) under which small and medium-sized enterprises declare their own information security efforts. It is not a certification with examinations or screening, and it is free of charge.
Why declarations are being requested now
One major reason is a national subsidy. The Digitalization / AI Adoption Subsidy 2026 requires applicants to hold a G Biz ID Prime account and to have made a SECURITY ACTION declaration at either the ★ one-star or ★★ two-star level. To avoid a last-minute rush just before applying, it is best to complete the declaration early.
One star vs. two stars
| ★ One star | ★★ Two stars | |
|---|---|---|
| Content | Declare that you are working on the "Six Information Security Articles" | Declare after completing the self-assessment and creating/publishing an information security policy |
| Work required beforehand | Work on the Six Articles (you may apply even if you are only about to start) | The 25-item self-assessment and publication of the policy must already be complete |
| Procedure | Apply via the SECURITY ACTION management system | Same |
If you are unsure, you can start with one star and step up to two stars later. Registration details and step-ups are handled from the management system's My Page.
The steps (for two stars)
Step 1: Get a G Biz ID Prime account
Since April 2026, declaration applications go through the SECURITY ACTION management system and require signing in with a G Biz ID (Prime for corporations and sole proprietors). Note that obtaining G Biz ID Prime takes days. The declaration must be filed with the same G Biz ID you will use for the subsidy application. In practice the account application is the slowest part of the whole process — start with it.
Step 2: Review the Six Information Security Articles
These are the six baseline efforts behind one star: keep operating systems and software up to date, deploy anti-virus software, use long and complex passwords without reuse, and similar basics. Compare them against your current state and note what is missing.
Step 3: Complete the self-assessment (two stars)
Answer IPA's "Five-Minute Information Security Self-Assessment" (25 items) and review your posture. A common misunderstanding is that a low score blocks the declaration — there is no minimum score; you can apply with any score. The score is not a pass/fail judgement; it shows where you are weak.
Step 4: Create and publish an information security policy (two stars)
Write a policy stating how your organization approaches information security, and publish it externally. Publication is often on your own website, but a website is not the only accepted method. For two stars, you apply only after this publication is done — mind the order.
Step 5: Apply in the management system
Sign in to the SECURITY ACTION management system with your G Biz ID and enter your business information and declaration details. For two stars you also enter your self-assessment score and when/how the policy was published. When the application completes, a self-declaration ID is issued and a completion email arrives. The logo can be downloaded from My Page afterwards.
Common pitfalls
- Leaving G Biz ID until last — issuance takes days, so starting just before a subsidy deadline may be too late.
- Declaring with a different G Biz ID than the subsidy one — the declaration must use the same G Biz ID as the subsidy application.
- Getting the two-star order wrong — self-assessment and policy publication come first; the application comes after.
- Treating it as a certification — it is a self-declaration; no third party examines or approves you.
For companies that declared earlier (old IDs)
Companies that declared before March 2026 may hold an old-style self-declaration ID (11 digits starting with "4"). From the subsidy application rounds after 17:00 on May 12, 2026, these old IDs cannot be used. Please apply again through the SECURITY ACTION management system with the G Biz ID you will use for the subsidy.
Doing it yourself vs. using support
The declaration itself is free and can be done entirely in-house. In practice, companies often stall on what the self-assessment items mean, how to word the policy, or which findings to fix first. HIXOR's "Security Health Check + SECURITY ACTION Declaration Support" (¥30,000, excl. tax) supports exactly those parts. The declaration application itself must, under the programme's rules, be submitted by the business. HIXOR itself has also made a ★★ (two-star) declaration.
* This article is based on the programme as of November 2026. Subsidy schedules and requirements can change; check the official sites for the latest information when applying.
* SECURITY ACTION is a self-declaration programme. Neither this article nor HIXOR's support guarantees that no information security incident will occur.
Official sources
- IPA — SECURITY ACTION official site: https://www.ipa.go.jp/security/security-action/
- Digitalization / AI Adoption Subsidy 2026 application guidelines (checked November 2026)
Official sources
Review your current posture with 25 questions. Runs in your browser only.