HIXORSECURITY ACTION One Star and Two Stars: How to Declare and What to Prepare
Key points
- Applying for the subsidy requires a G Biz ID Prime account and a SECURITY ACTION declaration at the one-star or two-star level
- One star declares work on the Six Information Security Articles; two stars adds the completed self-assessment and a published security policy
- The order matters for two stars: the 25-item self-assessment and policy publication come first, the application after
- Obtaining G Biz ID Prime takes the longest — start with it
"Please complete a SECURITY ACTION declaration" — many companies first see this phrase in a subsidy notice or a message from a business partner. This article explains the difference between one star and two stars, the concrete steps to a declaration, and the points where many companies stumble. (SECURITY ACTION is a Japanese programme for businesses in Japan; this English version is a faithful summary of the Japanese guide.)
SECURITY ACTION is a programme run by IPA (the Information-technology Promotion Agency, Japan) under which small and medium-sized enterprises declare their own information security efforts. It is not a certification with examinations or screening, and it is free of charge.
Why declarations are being requested now
One major reason is a national subsidy. The Digitalization / AI Adoption Subsidy 2026 requires applicants to hold a G Biz ID Prime account and to have made a SECURITY ACTION declaration at either the ★ one-star or ★★ two-star level. To avoid a last-minute rush just before applying, it is best to complete the declaration early.
One star vs. two stars
| ★ One star | ★★ Two stars | |
|---|---|---|
| Content | Declare that you are working on the "Six Information Security Articles" | Declare after completing the self-assessment and creating/publishing an information security policy |
| Work required beforehand | Work on the Six Articles (you may apply even if you are only about to start) | The 25-item self-assessment and publication of the policy must already be complete |
| Procedure | Apply via the SECURITY ACTION management system | Same |
If you are unsure, you can start with one star and step up to two stars later. Registration details and step-ups are handled from the management system's My Page.
The steps (for two stars)
Step 1: Get a G Biz ID Prime account
Since April 2026, declaration applications go through the SECURITY ACTION management system and require signing in with a G Biz ID (Prime for corporations and sole proprietors). Note that obtaining G Biz ID Prime takes days. The declaration must be filed with the same G Biz ID you will use for the subsidy application. In practice the account application is the slowest part of the whole process — start with it.
Step 2: Review the Six Information Security Articles
These are the six baseline efforts behind one star: keep operating systems and software up to date, deploy anti-virus software, use long and complex passwords without reuse, and similar basics. Compare them against your current state and note what is missing.
Step 3: Complete the self-assessment (two stars)
Answer IPA's "Five-Minute Information Security Self-Assessment" (25 items) and review your posture. A common misunderstanding is that a low score blocks the declaration — there is no minimum score; you can apply with any score. The score is not a pass/fail judgement; it shows where you are weak.
Step 4: Create and publish an information security policy (two stars)
Write a policy stating how your organization approaches information security, and publish it externally. Publication is often on your own website, but a website is not the only accepted method. For two stars, you apply only after this publication is done — mind the order.
Step 5: Apply in the management system
Sign in to the SECURITY ACTION management system with your G Biz ID and enter your business information and declaration details. For two stars you also enter your self-assessment score and when/how the policy was published. When the application completes, a self-declaration ID is issued and a completion email arrives. The logo can be downloaded from My Page afterwards.
Common pitfalls
- Leaving G Biz ID until last — issuance takes days, so starting just before a subsidy deadline may be too late.
- Declaring with a different G Biz ID than the subsidy one — the declaration must use the same G Biz ID as the subsidy application.
- Getting the two-star order wrong — self-assessment and policy publication come first; the application comes after.
- Treating it as a certification — it is a self-declaration; no third party examines or approves you.
For companies that declared earlier (old IDs)
Companies that declared before March 2026 may hold an old-style self-declaration ID (11 digits starting with "4"). From the subsidy application rounds after 17:00 on May 12, 2026, these old IDs cannot be used. Please apply again through the SECURITY ACTION management system with the G Biz ID you will use for the subsidy.
Doing it yourself vs. using support
The declaration itself is free and can be done entirely in-house. In practice, companies often stall on what the self-assessment items mean, how to word the policy, or which findings to fix first. HIXOR's "Security Health Check + SECURITY ACTION Declaration Support" (¥30,000, excl. tax) supports exactly those parts. The declaration application itself must, under the programme's rules, be submitted by the business. HIXOR itself has also made a ★★ (two-star) declaration.
* This article is based on the programme as of November 2026. Subsidy schedules and requirements can change; check the official sites for the latest information when applying.
* SECURITY ACTION is a self-declaration programme. Neither this article nor HIXOR's support guarantees that no information security incident will occur.
Official sources
- IPA — SECURITY ACTION official site: https://www.ipa.go.jp/security/security-action/
- Digitalization / AI Adoption Subsidy 2026 application guidelines (checked November 2026)
Official sources
Review your current posture with 25 questions. Runs in your browser only.
Check your understanding
Tap an answer to check yourself. Nothing is saved or sent.
Q1. What must already be complete when you apply for two stars?
See the answer
For two stars you apply only after the self-assessment and policy publication are done. The order matters.
Q2. If your self-assessment score is low, can you still declare?
See the answer
There is no minimum score. The score is not a pass/fail judgement — it shows you where your weak points are.
Q3. Which step takes the longest and should be started first?
See the answer
A G Biz ID Prime account takes days to obtain, and the declaration must be filed with the same ID used for the subsidy application.
Read next
Stop Reusing Passwords — The First Step
Why reusing the same password is dangerous (credential-stuffing / password-list attacks) and how to stop, step by step, based on official IPA and JPCERT/CC guidance.
Read more →