Japan Digital Agency Opens FY2026 Government-Cloud Security Audit Procurement

Japan's Digital Agency issued a procurement notice on September 10, 2026, seeking an FY2026 information-security audit of government-cloud operations. The notice establishes a defined opportunity for audit, assessment, cloud-assurance, and cybersecurity providers serving government cloud environments. Notably, the signal provides no contract value, award date, or contract number, meaning vendors must engage directly with the solicitation process to obtain pricing and schedule details. This is a government-cloud assurance requirement, distinct from commercial market activity, and it should be treated as a procurement pursuit rather than a market-sizing datapoint.

The procurement lands amid a broader tightening of Japan's cybersecurity posture. According to the National Cybersecurity Office of Japan, common cybersecurity standards for critical infrastructure entered into force on October 1, 2026, setting a baseline intended to be reflected in sector guidelines and operator programs. That regulatory shift expands the addressable demand for security assessment, integration, access control, and managed-security services across Japanese critical-infrastructure operators. For GovCon vendors with cloud-assurance credentials, the Digital Agency audit is an early, concrete expression of a compliance regime that will propagate through sector-specific guidelines in the months ahead.

Market context reinforces the direction of travel, though vendors must separate forecast growth from funded procurements. DataM Intelligence estimates the global zero-trust security market will grow from US$47.84 billion in 2025 to US$196.93 billion by 2035, a 15.2% CAGR from 2026 to 2035. North America held 41.4% of the market in 2025, while Asia-Pacific is identified as the fastest-growing region. These figures are market forecasts, not government contract funding, and companies should distinguish projected commercial market growth from actual funded opportunities when building pipelines. The forecast nonetheless signals where capability demand is concentrating: access controls spanning legacy systems, connected devices, and cloud environments.

Recent activity shows zero trust moving well beyond VPN replacement. Government agencies are addressing the safety and uptime constraints of operational technology (OT); Japanese carriers are applying cloud security to IoT devices; and AI infrastructure providers are adding controls over model access, data, and runtime environments. On April 29, CISA and federal partners published practical guidance for applying zero trust in OT, addressing legacy systems, safety requirements, network segmentation, supply-chain risks, and identity controls. On October 8, the NSA released guidance for applying zero trust to Department of War operational technology, including legacy systems and environments where cyber incidents can affect physical operations. Together, these documents create a reference architecture that procurement officers can cite in requirements, which in turn shapes evaluation criteria for assessment and integration contracts.

Commercial and carrier activity is converging on the same requirements set. On June 15, NTT DOCOMO BUSINESS and TRANSATEL, with Zscaler, launched a carrier offering using SIM-based connectivity and zero-trust security without conventional VPNs or software agents on devices, supporting deployments in more than 200 countries and territories. On September 9, GDIT announced Everest Zero Trust, comprising assessment and planning, modular upgrades for existing systems, and a full-stack option; GDIT said it had deployed the solutions in more than 40 mission environments, including across 187 Air Force bases. On October 21, CoreWeave announced a framework giving customers zero-trust controls for AI infrastructure. Each of these moves brings implementation, audit, and managed-service opportunities alongside software sales — precisely the service categories the Digital Agency audit is designed to procure.

• Japan's Digital Agency issued a September 10, 2026 procurement notice for an FY2026 information-security audit of government-cloud operations.
• The notice discloses no contract value, award date, or contract number; vendors must obtain these details through the solicitation.
• Japan's National Cybersecurity Office confirmed common critical-infrastructure cybersecurity standards entered into force October 1, 2026, to be reflected in sector guidelines and operator programs.
• DataM Intelligence projects the global zero-trust market at US$196.93 billion by 2035, up from US$47.84 billion in 2025, at a 15.2% CAGR (forecast, not contract funding).
• North America held 41.4% of the 2025 market; Asia-Pacific is the fastest-growing region.
• CISA published OT zero-trust guidance on April 29; the NSA released Department of War OT guidance on October 8.
• NTT DOCOMO BUSINESS and TRANSATEL, with Zscaler, launched SIM-based zero-trust IoT connectivity on June 15, covering 200+ countries and territories.
• GDIT launched Everest Zero Trust on September 9, citing deployment in 40+ mission environments and across 187 Air Force bases.
• CoreWeave announced a zero-trust framework for AI infrastructure on October 21.
• Actionable insight: audit, assessment, cloud-assurance, and managed-security providers should track the Digital Agency notice alongside Japanese sector guidelines, while treating commercial market forecasts as planning inputs only.