DocuSign Envelope ID: 41B70F8B-45BF-4528-B36B-544CA1EECD6C

Certificate
Certificate number: 2020-002
Certified by EY CertifyPoint since: January 29, 2020
Based on certification examination in conformity with defined requirements in ISO/IEC
17021-1:2015 and ISO/IEC 27006:2015/A1:2020, the Information Security
Management System as defined and implemented byInternet Initiative Japan Inc.*
Management System: NW
located in Tokyo, Japan is compliant with the requirements as stated in the standard:

ISO/IEC 27017:2015
Issue date of certificate: December 5, 2022
Re-issue date of certificate: March 25, 2024
Expiration date of certificate: December 7, 2025
Last certification cycle expiration date: December 7, 2022

EY CertifyPoint will, according to the certification agreement dated September 15,2022, perform surveillance audits and acknowledge the certificate until the expiration
date noted above.
*The certification is applicable for the assets, services and locations as described in the scoping section at
the back of this certificate, with regard to the specific requirements for information security as stated in
the respective Statement of Applicability documents for the in-scope services.

J. Sehgal | Director, EY CertifyPoint
This certificate is not transferable and remains the property of Ernst & Young CertifyPoint B.V, located at Antonio Vivaldistraat 150, 1083 HP, Amsterdam, the Netherlands. Any dispute relating to this certificate
shall be subject to Dutch law in the exclusive jurisdiction of the court in Rotterdam. The content must not be altered and any promotion by employing this certificate or certification body quality mark must adhere
to the scope and nature of certification and to the conditions of contract. Given the nature and inherent limitations of sample-based certification assessments, this certificate is not meant to express any form ofassurance on the performance of the organization being certified to the referred ISO standard. The certificate does not grant immunity from any legal/ regulatory obligations. All rights reserved. © Copyright

Page 1 of 3

Digital version

DocuSign Envelope ID: 41B70F8B-45BF-4528-B36B-544CA1EECD6C

Internet Initiative Japan Inc.
Scope for certificate 2020-002
The scope of this ISO/IEC 27017:2015 certification is as follows:
The scope of this ISO/IEC 27017:2015 certification is limited to the scope of the Cloud
Security framework as established with the Information Security Management Systemcurrently implemented for NW Management System.
The services in-scope of the management system are:
► IIJ Secure MX Service (SMX, Statement of Applicability version 1.4)
► IIJ DNS Platform Service (DPF, Statement of Applicability version 1.0)
► IIJ Cloud Proxy Service (CPX, Statement of Applicability version 1.2)
► IIJ Flex Mobility Service (FXM, Statement of Applicability version 1.2)
► IIJ Flex Mobility Service/ZTNA (FXZ, Statement of Applicability version 1.2)
► IIJ xSP Platform Service/Mail (XMAIL, Statement of Applicability version 1.2)
► IIJ Private Backbone Service (PBB, Statement of Applicability version 1.1)
► IIJ Private Access Service (PVA, Statement of Applicability version 1.1)
► IIJ ID Service (IID, Statement of Applicability version 1.0)
► IIJ Cloud Exchange Service/Type M, Type M2, Type A, Type G, Type R (CX,Statement of Applicability version 1.0)
► IIJ Private Backbone Service/Smart HUB (SHB, Statement of Applicability version1.0)► IIJ Omnibus Service/WAN Unit (Omnibus, Statement of Applicability version 1.0)
► IIJ Directory Service for Microsoft (IAD, Statement of Applicability version 1.0)
► IIJ Virtual Desktop Service/Citrix Cloud for Azure Virtual Desktop (CTX, Statementof Applicability version 1.0)
The locations in-scope of the management system are:► Iidabashi HQ (Iidabashi Grand Bloom, 2-10-2 Fujimi, Chiyoda-ku, Tokyo, Japan)► Kyushu (Hakatagion M-SQUARE, 3F, 2-1 Reisen-machi Hakata-ku, Fukuoka-shi,Fukuoka, Japan)► Matsue (57 and 59, Hokuryo-cho, Matsue-shi, Shimane, Japan)► Shibuya (KDDI Building 4-4-8 Aobadai Meguro-ku, Tokyo, Japan)► Nerima (Nerima-Toyotama Building 3-18-1 Toyotamakita Nerima-ku, Tokyo,Japan)► Shiroi (5-1-1 Sakuradai Shiroi-shi, Chiba, Japan)► Otemachi (KDDI Otemachi Building, 1-8-1 Otemachi, Chiyoda-ku, Tokyo, Japan)► Dojima (NTT Telepark Doujima Dai 3 Building, 3-1-7 Doujima, Kita-ku, Osaka-shi,Osaka, Japan)► Kozu (NTT Shin Kozu Building, 1-3-30, Kawarayamachi, Chuo-ku, Osaka-shi,Osaka, Japan)► Shinsaibashi (Keihanshin Kita Horie Building, 6F, 3-6-11, Kitahorie, Nishi-ku,Osaka-shi, Osaka, Japan)

This scope is only valid in connection with certificate 2020-002.
Page 2 of 3Digital version

DocuSign Envelope ID: 41B70F8B-45BF-4528-B36B-544CA1EECD6C

Internet Initiative Japan Inc.
Scope for certificate 2020-002
The Information Security Management System is centrally managed out of Iidabashi HQ,Grand Bloom 2-10-2 Fujimi, Chiyoda-ku, Tokyo, Japan.
Approximately 278 people are in scope of the management system.

The Information Security Management System mentioned in the above scope isrestricted as defined in “Scope definition document” version 1.5 dated October 16,
2023 for SMX, version 1.2 dated February 4, 2022 for DPF, version 1.3 dated August29, 2023 for CPX, version 1.3 dated July 31, 2023 for FXM and FXZ, version 1.3 dated
August 30, 2023 for XMAIL, version 1.3 dated October 12, 2023 for PBB and PVA,version 2.0 dated September 28, 2023 for IID , version 1.1 dated October 12, 2023 forCX, version 1.0 dated October 12, 2023 for SHB, version 1.0 dated October 12, 2023for Omnibus, version 1.0 dated October 4, 2023 for IAD, version 1.0 dated October 4,2023 for VDS.

This scope is only valid in connection with certificate 2020-002.
Page 3 of 3Digital version