NEWS RELEASE
October 30, 2023
(Temporary translation Reference Only)

JaSRO partners with Kompleye to launch support services for information security
measures towards CMMC2.0 promoted by the U.S. Department of Defense,
Support service for information security measures has started
Japan Security Rating Organization (abbreviated title: JaSRO, headquartered in Chuo-ku, Tokyo) has
formed a business partnership with Kompleye (headquartered in Reston, VA) and will begin providing
support services for information security measures in accordance with CMMC 2.0 from November 2023.

1.Purpose
The U.S. Department of Defense (hereinafter referred to as DoD) plans to conduct procurement using theCybersecurity Maturity Model Certification (hereinafter referred to as CMMC), and the second edition of theCMMC (hereinafter referred to as CMMC 2.0), which will serve as the standard, was released in December
2021. CMMC 2.0 uses the existing US standard (NIST SP800-171) as the core of its control measures.
Procurement of defense equipment from Japanese companies is also subject to this. By 2025, when the newstandard is expected to be fully applied, Japanese companies will be required to conduct self-certification or
third-party certification depending on the level of security required for procurement.
Therefore, JaSRO will start supporting CMMC2.0 compliance with its experience and know-how in
information security rating using NIST SP800-171. In addition, JaSRO has formed a business alliance withKompleye, a U.S. audit organization, which enables JaSRO to provide services with an improved support
system. Kompleye is officially accredited as a C3PAO (certified third-party assessment organization) andactively cooperate with CMMC-AB (Cybersecurity Maturity Model Certification Accreditation Body) in the
promotion and advancement of CMMC2.0.

2.Service Details
JaSRO will work to help Japanese companies prepare for CMMC smoothly and the third-party certification
for the CMMC is expected to be performed by Kompleye as an authorized CMMC C3PAO. Please specify theservices you require from the "Services" section below. We will assist you in obtaining third-party CMMC
certification by focusing on issues you are facing and resolving them in an appropriate and efficient manner.
CMMC2.0 defines evaluation methods according to the level of information handled. Level 1 (correspondingto Federal Contract Information) allows self-certification. Level 2 (corresponding to Controlled UnclassifiedInformation) requires either self-certification or certification by a third-party organization, depending on theJapan Security Rating Organization (JaSRO) E-mail:info@jasro.org http://www.jasro.org
News releases are the current views of JaSRO based on information obtained from relevant institutions and organizations and d o not guarantee their accuracy, completeness,comprehensiveness, etc. for now and in future years. JaSRO shall not be liable for any claims, lawsuits, or other disputes related to the news release, or for any damages,
losses, or expenses that may be incurred by relevant institutions and organizations or any other third party.

1Copyright (C) 2023 JaSRO All rights reserved.

NEWS RELEASE
type of information handled.
In addition, the use of Plan of Action & Milestones (abbreviated as POA&M) was approved for some low
priority control measures. It is expected that service providers will be able to respond to some of the CMMC
2.0 requirements by preparing POA&Ms that take action within 180 days.
Based on the above CMMC requirements, JaSRO plans to support effective CMMC readiness for selfcertification and third-party certification by utilizing the Level 1 and Level 2 CMMC 2.0 compliant selfassessment tools (free of charge) developed by Kompleye.
[ Services (typical examples)](1) Support for CMMC self-certification measures (for Level 1 and part of Level 2, *1)(2) Support for CMMC third-party certification measures (for part of level 2, *1)(3) Support for preparation of POA&M (Plan of Action and Milestones)(4) Support for revision of manuals for CMMC implementation(5) Support for internal audits of CMMC implementation (audit preparation, audit implementation, andreporting)(6) Assistance in conducting management reviews for CMMC implementation(7) Attend audits for CMMC third-party certification (record and provide advice)(8) Assistance in responding to issues raised in CMMC third-party certification (follow-up until completion ofaudit and response to issues raised)(9) Assistance in dealing with external contractors, etc. (surveys, questionnaire response, support for CMMC
response, etc.)
The above*1 will utilize the self-assessment tool provided by Kompleye.
[ Service Price](1) Please specify the required services from [Services (typical examples)] above. We will prepare anindividual quotation.

3. Other Related Services
JaSRO also provides information security rating service to assess compliance with NIST SP800-171 andsupport service for Information system Security Management and Assessment Program (ISMAP). If you
would like to take measures consistent with those requirements when complying with the CMMC, please let
us know. We will put together a support team that will be able to respond to your needs.
(Reference service examples)
Examples of information security ratings for U.S. standards (NIST SP800-171/172, etc.)

Japan Security Rating Organization (JaSRO) E-mail:info@jasro.org http://www.jasro.org
News releases are the current views of JaSRO based on information obtained from relevant institutions and organizations and d o not guarantee their accuracy, completeness,comprehensiveness, etc. for now and in future years. JaSRO shall not be liable for any claims, lawsuits, or other disputes related to the news release, or for any damages,
losses, or expenses that may be incurred by relevant institutions and organizations or any other third party.

2Copyright (C) 2023 JaSRO All rights reserved.

NEWS RELEASE
http://jasro.org/news/pdf/JaSRO_NewsRelease_20221228.pdf
https://www.nikkei.com/article/DGXZRSP646952_Y2A221C2000000/
Support for registration with Information system Security Management and Assessment Program(ISMAP)
http://jasro.org/news/pdf/JaSRO_NewsRelease_20221026.pdf

4. Introduction of Business Partners
Please refer to the following link for a description of Kompleye's CMMC services.
https://www.kompleye.com/cmmc/
Kompleye is officially accredited by Cyber-AB (The official accreditation body of CMMC) as a C3PAO(Certified 3rd Party Assessment Organization).

5. Contact Information
Individual inquiries can be made at any time via the web conference system, etc.
If you would like to have a meeting, please send an e-mail to info@jasro.org.
Contact us for more information.
Japan Security Rating Organization
JaSRO (Japan Security Rating Organization)planning department
E-mail: info@jasro.org
http://www.jasro.org/

JaSRO is the world's first third-party information security rating agency.
−

We are working to create a social system in which the level of information management measures isverified by "rating" each other.

−

We provide support for the establishment and internal audit in compliance with Information system
Security Management and Assessment Program (ISMAP).

−

We provide support for constructing compliance with government guidelines, NIST SP800-171/172, etc.,
and internal audits.

−

We support the transition to the ISO/IEC27001 (ISMS) standards (declaration of application, manuals,education and training, etc.) in accordance with the revision of ISO/IEC27001 (ISMS) and otherstandards.

Japan Security Rating Organization (JaSRO) E-mail:info@jasro.org http://www.jasro.org
News releases are the current views of JaSRO based on information obtained from relevant institutions and organizations and d o not guarantee their accuracy, completeness,comprehensiveness, etc. for now and in future years. JaSRO shall not be liable for any claims, lawsuits, or other disputes related to the news release, or for any damages,
losses, or expenses that may be incurred by relevant institutions and organizations or any other third party.

3Copyright (C) 2023 JaSRO All rights reserved.