DocuSign Envelope ID: 41B70F8B-45BF-4528-B36B-544CA1EECD6C

Certificate
Certificate number: 2020-001
Certified by EY CertifyPoint since: January 29, 2020
Based on certification examination in conformity with defined requirements in ISO/IEC
17021-1:2015 and ISO/IEC 27006:2015/A1:2020, the Information Security
Management System as defined and implemented byInternet Initiative Japan Inc.*
Management System: SEC
located in Tokyo, Japan is compliant with the requirements as stated in the standard:

ISO/IEC 27017:2015
Issue date of certificate: December 5, 2022
Re-issue date of certificate: March 25, 2024
Expiration date of certificate: December 7, 2025
Last certification cycle expiration date: December 7, 2022

EY CertifyPoint will, according to the certification agreement dated September 15,2022, perform surveillance audits and acknowledge the certificate until the expiration
date noted above.
*The certification is applicable for the assets, services and locations as described in the scoping section at
the back of this certificate, with regard to the specific requirements for information security as stated in
the respective Statement of Applicability documents for the in-scope services.

J. Sehgal | Director, EY CertifyPoint
This certificate is not transferable and remains the property of Ernst & Young CertifyPoint B.V, located at Antonio Vivaldistraat 150, 1083 HP, Amsterdam, the Netherlands. Any dispute relating to this certificate
shall be subject to Dutch law in the exclusive jurisdiction of the court in Rotterdam. The content must not be altered and any promotion by employing this certificate or certification body quality mark must adhere
to the scope and nature of certification and to the conditions of contract. Given the nature and inherent limitations of sample-based certification assessments, this certificate is not meant to express any form ofassurance on the performance of the organization being certified to the referred ISO standard. The certificate does not grant immunity from any legal/ regulatory obligations. All rights reserved. © Copyright

Page 1 of 2Digital version

DocuSign Envelope ID: 41B70F8B-45BF-4528-B36B-544CA1EECD6C

Internet Initiative Japan Inc.
Scope for certificate 2020-001
The scope of this ISO/IEC 27017:2015 certification is as follows:
The scope of this ISO/IEC 27017:2015 certification is limited to the scope of the Cloud
Security framework as established with the Information Security Management Systemcurrently implemented for SEC Management System.
The services in-scope of the management system are:
► IIJ Secure Web Gateway Service (SWG, Statement of Applicability for services
provided by SEC management system version 1.2)
► IIJ DDoS Protection Service (YDS, Statement of Applicability for services provided
by SEC management system version 1.2)
► IIJ Managed WAF Service (MWAF, Statement of Applicability for services provided
by SEC management system version 1.2)
► IIJ GIO Remote Access Service (GAM, Statement of Applicability for services
provided by SEC management system version 1.2)
The locations in-scope of the management system are:► Iidabashi HQ (Iidabashi Grand Bloom, 2-10-2 Fujimi, Chiyoda-ku, Tokyo, Japan)
There are other locations in-scope of the management system, however, these have notbeen explicitly mentioned on this certificate due to security concerns.
The Information Security Management System is centrally managed out of Iidabashi HQ,Grand Bloom 2-10-2 Fujimi, Chiyoda-ku, Tokyo, Japan
Approximately 45 people are in scope of the management system.

The Information Security Management System mentioned in the above scope isrestricted as defined in the scope document version 1.2, dated August 28, 2023 forMWAF, YDS, SWG and GAM.

This scope is only valid in connection with certificate 2020-001.
Page 2 of 2Digital version