DocuSign Envelope ID: 41B70F8B-45BF-4528-B36B-544CA1EECD6C

Certificate
Certificate number: 2017-001
Certified by EY CertifyPoint since: January 27, 2017
Based on certification examination in conformity with defined requirements in ISO/IEC
17021-1:2015 and ISO/IEC 27006:2015/A1:2020, the Information Security
Management System as defined and implemented byInternet Initiative Japan Inc.*
Management System: CDlocated in Tokyo, Japan is compliant with the requirements as stated in the standard:

ISO/IEC 27017:2015
Issue date of certificate: December 5, 2022
Re-issue date of certificate: March 25, 2024
Expiration date of certificate: December 7, 2025
Last certification cycle expiration date: December 7, 2022

EY CertifyPoint will, according to the certification agreement dated September 15,2022, perform surveillance audits and acknowledge the certificate until the expiration
date noted above.
*The certification is applicable for the assets, services and locations as described in the scoping section at
the back of this certificate, with regard to the specific requirements for information security as stated in
the respective Statement of Applicability documents for the in-scope services.

J. Sehgal | Director, EY CertifyPoint
This certificate is not transferable and remains the property of Ernst & Young CertifyPoint B.V, located at Antonio Vivaldistraat 150, 1083 HP, Amsterdam, the Netherlands. Any dispute relating to this certificate
shall be subject to Dutch law in the exclusive jurisdiction of the court in Rotterdam. The content must not be altered and any promotion by employing this certificate or certification body quality mark must adhere
to the scope and nature of certification and to the conditions of contract. Given the nature and inherent limitations of sample-based certification assessments, this certificate is not meant to express any form ofassurance on the performance of the organization being certified to the referred ISO standard. The certificate does not grant immunity from any legal/ regulatory obligations. All rights reserved. © Copyright

Page 1 of 3

Digital version

DocuSign Envelope ID: 41B70F8B-45BF-4528-B36B-544CA1EECD6C

Internet Initiative Japan Inc.
Scope for certificate 2017-001
The scope of this ISO/IEC 27017:2015 certification is as follows:
The scope of this ISO/IEC 27017:2015 certification is limited to the scope of the Cloud
Security framework as established with the Information Security Management Systemcurrently implemented for CD Management System.
The services in-scope of the management system are:
► IIJ GIO Infrastructure P2/ IIJ GIO Infrastructure P2 Gen.2 (GIO-P2/GRP,Statement of Applicability version 1.5)
► IIJ GIO Content Acceleration Service (CAS, Statement of Applicability version1.1)► IIJ Web High-Grade 2 Service and Cloud Web Hosting Service (WH2 and CWH,
Statement of Applicability version 1.2)
► IIJ Document Exchange Service (DOX6, Statement of Applicability version 1.1)
► IIJ Unified Operation Management Service (UOM, Statement of Applicability
version 1.0)
► IIJ Cloud Data Platform Service (CDP, Statement of Applicability version 1.0)
► IIJ Managed Database Service (MDS, Statement of Applicability version 1.0)
► IIJ Simple Backup Service (SBU, Statement of Applicability version 1.0)
The locations in-scope of the management system are:► Iidabashi HQ (Iidabashi Grand Bloom, 2-10-2 Fujimi, Chiyoda-ku, Tokyo, Japan)► Matsue (57 and 59, Hokuryo-cho, Matsue-shi, Shimane, Japan)► Tsuzuki (Yokohama Techno Building, 1-1 Ninomaru, Tsuzuki-ku, Yokohama-shi,Kanagawa, Japan)► Osaka (2nd Sumitomo Building, 4-7-28 Kitahama, Chuo-ku, Osaka-shi, Osaka,Japan)► Nerima (Nerima-Toyotama Building 3-18-1 Toyotamakita Nerima-ku, Tokyo,Japan)► Shiroi (5-1-1 Sakuradai Shiroi-shi, Chiba, Japan)► Mitaka (MMC Mitaka Building, 8-7-2 Shimorenjyaku, Mitaka-shi, Tokyo, Japan)► Moriyama (Toyotsu System Techno Center, 1201 Hiraike higashi, Moriyama-ku,Nagoya-shi, Aichi, Japan)
The Information Security Management System is centrally managed out of Iidabashi HQ,Grand Bloom 2-10-2 Fujimi, Chiyoda-ku, Tokyo, Japan.
Approximately 195 people are in scope of the management system.

This scope is only valid in connection with certificate 2017-001.
Page 2 of 3Digital version

DocuSign Envelope ID: 41B70F8B-45BF-4528-B36B-544CA1EECD6C

Internet Initiative Japan Inc.
Scope for certificate 2017-001
The Information Security Management System mentioned in the above scope isrestricted as defined in “Scope definition document” version 1.8, dated July 27, 2023
for GIO-P2, version 1.3 dated July 22, 2022 for CAS, version 1.3 dated July 27, 2023
for WH2/CWH, version 1.1 dated June 24, 2021 for DOX6, version 1.4 November 17,2023 for UOM, version 1.0 October 17, 2023 for CDP, version 1.0 October 17, 2023 forMDS, version 1.0 October 17, 2023 for SBU.

This scope is only valid in connection with certificate 2017-001.
Page 3 of 3

Digital version