LinkT&B Editorial Department
Small-business security starts with the information and operations to protect, then sustainable patching, authentication, backups and incident contacts. Check whether staff can carry out the procedures and restore service, not just whether products have been installed.
Contents
- Assign an owner and a date to the first controls
- IPA guidelines updated to version 4.0
- VPN devices remain an important entry point
- A condition of doing business is not to become a weak point in the supply chain.
- Practical measures that small and medium-sized enterprises should take
- The first step is SECURITY ACTION
- Subsidies and support systems will be used to “fill the gap in labor shortages”
- Summary
- Free diagnosis information
- Related Articles
- Discuss your project
Assign an owner and a date to the first controls
| Item | What to check | How to assess it |
|---|---|---|
| Updates | Endpoints, servers and network devices | Inventory and deployment verification |
| Authentication | Administrators, email and key services | MFA and recovery methods |
| Recovery | Backups, contacts and alternatives | An actual restoration test |
IPA guidelines updated to version 4.0
The first standard that small and medium-sized enterprises should refer to is IPA's "Guidelines for Information Security Measures for Small and Medium-sized Enterprises." The 4.0 version was released on March 27, 2026, and added “Take a backup!” to the previous 5 items, making it 6 items. In addition, the “In-house Information Security Diagnosis in 5 Minutes” has added perspectives on blocking unnecessary communication from external to internal networks and safe operation of websites, and also includes appendices on the concept of the SCS evaluation system and human resources recruitment and training. In other words, the latest edition has evolved from being just an educational material to a practical book that makes it easy to decide step-by-step what to do and how far to do it. (Source: IPA "Press announcement: 'Information security measures guidelines for small and medium-sized enterprises' version 4.0 released", IPA "Information security measures guidelines for small and medium-sized enterprises")
VPN devices remain an important entry point
You may see the expression "VPN devices account for 63% of infection routes," but according to detailed figures published by the National Police Agency, 63 out of 102 valid responses were via VPN devices, making the percentage 62%. In addition, according to the National Police Agency's 2024 published data, 23.3% of the 206 cases of unauthorized access were due to “using an old version or not installing patch programs or necessary plug-ins.” The National Police Agency's 2025 alert also repeatedly calls for updating the software of VPN devices and ensuring strong passwords. Postponing updates should be considered as an act of leaving the entrance you most want to avoid. (Source: National Police Agency “Reiwa 5 Police White Paper”, National Police Agency “Cyber Police Bureau Newsletter R7Vol.4”, National Police Agency “Materials released on March 14, 2024”)
A condition of doing business is not to become a weak point in the supply chain.
According to IPA's 2024 survey, over 10% of companies have received requests from business partners for information security measures. Additionally, approximately 60% of companies that have a security system in place and approximately 70% of companies that have obtained third-party certification responded that this led to transactions. In IPA's “Top 10 Information Security Threats 2026,” “attacks targeting supply chains and subcontractors” ranked second among threats to organizations. The lack of countermeasures by small and medium-sized enterprises is not just a problem for the company itself, but has become a management issue that can lead to suspension of transactions and loss of order opportunities. (Source: IPA “2024 Survey on Information Security Measures in Small and Medium Enterprises”, IPA “Top 10 Information Security Threats 2026”)
Practical measures that small and medium-sized enterprises should take
The first step is SECURITY ACTION
If you're not sure where to start, IPA's SECURITY ACTION is a practical option. ★One star is a declaration of future commitment to the “Six Points of Information Security” and can be applied for even before the measures are implemented. ★★Two stars are declarations made after conducting a 25-item "in-house information security diagnosis that can be done in 5 minutes", creating a basic information security policy, and disclosing it to the public. It is natural for beginners at a company to start with a one-star position and move on to a two-star position once internal rules and external explanations are in place. (Source: IPA "SECURITY ACTION 'One Star'" "SECURITY ACTION 'Two Stars'")
IPA version 4.0 organizes the practical version into four steps. The following is a table of countermeasures summarized in three stages that is easy for small and medium-sized businesses to use. (Source: IPA “Information Security Measures Guidelines for Small and Medium Enterprises, Version 4.0”)
| level | Main measures | Aim |
|---|---|---|
| Beginner | Password management (no reuse, long password, preferably MFA), OS/software updates, backup including offline | Make it difficult to intrude, and shorten business downtime even if intrusion occurs |
| Intermediate | Introduction of UTM (devices that collectively monitor and control communications), log monitoring, development of basic information security policies and regulations, preparation of ISMS (information security management system) | Reduce dependence on personnel and make it easier to explain to business partners and continue operations |
| advanced | Utilization of SOC (monitoring center; can also be outsourced), penetration testing (examination to identify weaknesses through simulated attacks), incident response planning and training | Reduce recovery time and prepare for accountability to key customers and audits |
The key is not to start with expensive products all of a sudden. Even just these three basic points can significantly reduce the major risks of “lack of updating,” “weak authentication,” and “impossibility of recovery,” which the National Police Agency has repeatedly warned of. For companies with concurrent personnel, simply deciding how to view logs and who to report to at an intermediate level can greatly reduce the chance of overlooking damage or delaying the initial response. (Source: National Police Agency “Cyber Police Bureau Newsletter R7 Vol.4”, IPA “Information Security Measures Guidelines for Small and Medium Enterprises Version 4.0”)
Subsidies and support systems will be used to “fill the gap in labor shortages”
As for the latest public support, the Small and Medium Enterprise Agency released the application guidelines for the "Digitalization/AI Introduction Subsidy 2026" on March 10, 2026. This is a successor to the old IT introduction subsidy, and is a system that supports the introduction of IT tools including AI. According to guidance from the Small and Medium Enterprise Agency, the maximum subsidy amount is 4.5 million yen, the subsidy rate is 1/2 to 4/5, and there is also a framework for promoting security measures. First of all, it is realistic to consider “protective operations” as an expense that can be compensated for by external forces. (Source: Small and Medium Enterprise Agency “Public Call Guidelines for Digitalization/AI Introduction Subsidy 2026 Released”, Small and Medium Enterprise Agency “Digitalization/AI Introduction Subsidy 2026 Overview”)
For companies lacking human resources, IPA's “Cyber Security Help Team Service” is also effective. It is a one-package type that allows you to choose between network monitoring, terminal monitoring, and a combination of both, allowing you to use monitoring functions such as UTM and EDR all at once. In addition, at IPA's cybersecurity consultation desk for corporate organizations, you can receive initial consultation when an incident occurs, necessary first aid measures, and information on specialized companies and reporting locations. For companies that cannot increase the number of employees, it will be faster and safer to design with external support in mind. (Source: IPA “Cyber Security Help Team Service”, IPA “Cyber Security Consultation/Notification Counter List”)
Summary
The starting point for security measures for small and medium-sized businesses is to "keep the basics going without stopping" rather than relying on difficult techniques. The latest version of the IPA Guidelines, version 4.0, includes six articles including backup, step-by-step steps, templates, and in-house diagnostics, making it easier to take the first step. First, declare a SECURITY ACTION and establish four points: passwords, updates, backups, and reporting destinations. If you can do that, you can easily move on to UTM, log monitoring, and regulation development. Security is not a cost; it is the foundation for continuing business and maintaining trust. (Source: IPA "Information Security Measures Guidelines for Small and Medium Enterprises Version 4.0", IPA "SECURITY ACTION 'One Star'")
Free diagnosis information
If you don't know where your company's countermeasure level is, a shortcut is to start by understanding the current situation. Visualize your issues and organize your priorities with Free Security Diagnosis. For inquiries, please use the Contact form.
Related Articles
Multi-Factor Authentication: What It Does and Where It Falls Short
How Safe Is Cloud AI Data? The Case for Local LLMs
:Further reading: IPA: Information Security Guidelines for SMEs
Discuss your project
We support website security, monitoring and maintenance. Tell us about your current setup and the operational work you need to improve.