Skip to main content
RUOK

Innovation Platform Agency, Japan (IPA)

Information Security Management Examination (SG)

The Information Security Management Examination (SG) is one category of the Information Technology Engineers Examination run by the Innovation Platform Agency, Japan (IPA). IPA describes the target candidate as someone in a user department who acts as an information security leader: a person who understands the security measures their department's work requires and the organisation's own information security rules, and who establishes, maintains and improves a state in which information and information systems can be used safely. Because the examination is aimed at people who use IT rather than at engineers who build it, technical items are excluded from the syllabus. It is delivered by computer-based testing throughout the year, and Section A and Section B are taken together within a single 120-minute session. Two priority fields are set, security and legal affairs, so information security controls and ISMS are examined alongside related legislation. Section A asks knowledge questions and Section B asks skills questions, both in multiple-choice form, and a pass is decided on a total scaled score of 600 or more out of 1,000, calculated with item response theory.

Official page

Who takes it

  • Staff in user departments who are responsible for their department's information security measures and for applying the company's internal rules
  • Managers in departments such as general affairs, HR and accounting that handle personal or sensitive information every day
  • Department heads and team leaders who decide whether an outsourcing arrangement or a cloud service may be used
  • People who have passed the IT Passport Examination and want to go one level deeper into information security
  • People who are not in technical roles but have become involved in the organisation's incident response arrangements, such as a CSIRT

What it lets you do

  • It is a category of the Information Technology Engineers Examination, and IPA states that a pass has no expiry date and that past passes do not become invalid.
  • The syllabus is designed for people who use IT, with technical items deliberately excluded, so study stays within a range that non-technical staff can handle.
  • Two priority fields are set, security and legal affairs, so information security controls and ISMS can be covered together with related legislation such as the Basic Act on Cybersecurity, the Act on Prohibition of Unauthorized Computer Access and the Act on the Protection of Personal Information.
  • Section B is set as a paper that tests skills, so questions are framed as judgements to be made in the context of internal rules and incidents.
  • It is delivered by CBT throughout the year, so the exam date can be set to match an internal transfer or a change of responsibilities.

The exam

As published by Innovation Platform Agency, Japan (IPA). Anything we could not confirm is left out. Check the official page before you apply.

Questions
60 questions (Section A 48, Section B 12). The score is calculated from 54 of them; the remaining 6 are used to evaluate questions for future examinations.
Time
120 minutes (Section A and Section B are taken together within a single exam session)
Pass mark
A total scaled score of 600 or more out of 1,000. Scaled scores are calculated from the answers using item response theory (IRT). There is no separate pass mark per section; the decision rests on the total scaled score alone.
Fee
JPY 7,500 (consumption tax included)
Format
CBT. Section A is multiple choice with four options and tests knowledge; Section B is multiple choice and tests skills.
Languages
Japanese
When it runs
Delivered by CBT throughout the year (up to FY2022 it was held in a first-half and a second-half sitting).
Validity and renewal
No expiry. IPA states that a pass has no expiry date and that past passes do not become invalid.

How hard it is

In FY2025 (Reiwa 7) there were 50,226 applicants, 45,924 candidates and 32,141 passes, a pass rate of 70.0% (IPA statistics, March 2026 edition). The result is decided not on raw marks but on an IRT-based total scaled score of 600 or more out of 1,000.

How long people study

Not published by the exam body. IPA does not state an expected study time. Commercial study guides commonly cite a rough figure of about 50 to 100 hours, but that is not a figure published by the exam body.

Syllabus

  • [Priority field] Technology, Technology Element / Security (information security, information security management, security technology evaluation, information security measures, security implementation technology)
  • [Priority field] Strategy, Corporate and Legal Affairs / Legal Affairs (intellectual property rights, laws on security, laws on labor and transaction, other laws, guidelines and engineer ethics, standardization)
  • Technology, Computer System / System Component (system configuration, system evaluation indexes)
  • Technology, Technology Element other than Security / Database, Network
  • Management, Project Management / Project Management
  • Management, Service Management / Service Management, System Audit
  • Strategy, System Strategy / System Strategy, System Planning
  • Strategy, Corporate and Legal Affairs other than Legal Affairs / Corporate Activities (management and organization theory, business analysis and data utilization, accounting and financial affairs)

Our apps and books for this exam

  • Joho Security Goukaku Taisaku Drill

    Japanese only

    Information Security Management Examination (IPA) practice drills

    This app's interface and questions are in Japanese.

    Download on the App Store

Questions people ask

Do I pass if I answer 60% correctly?
The standard is not 60% of raw marks. The examination outline states that scores are calculated from the answers using item response theory (IRT), and the pass standard is a total scaled score of 600 or more out of 1,000. The number of correct answers and the scaled score are not in simple proportion.
Do I have to clear a pass mark in Section A and in Section B separately?
No. The examination outline provides that in the Information Security Management Examination a candidate passes when the total scaled score is at or above the pass mark, and no per-section pass marks are set. This differs from the Fundamental Information Technology Engineer Examination, which does have a pass mark for each section.
Are all 60 questions marked?
No. The examination outline states that the score is calculated from 54 of the 60 questions, and that the remaining 6 are used to evaluate questions for future examinations. The breakdown is 48 questions in Section A and 12 in Section B.
How far do the technical topics such as cryptography and networking go?
The scope in the examination outline states explicitly that, because the examination is aimed mainly at people who use IT, technical items are excluded. That said, the list of knowledge items includes symmetric and public key cryptography, hash functions, IPsec and SSL/TLS, so they are examined to the extent a user needs to understand them.
When is the examination held? Are the sections taken separately, as in the Fundamental Information Technology Engineer Examination?
It is delivered by CBT throughout the year, with no fixed exam dates. Unlike the Fundamental Information Technology Engineer Examination, Section A and Section B are taken together within a single 120-minute session.

Sources

These are the pages the figures came from. Some are published in Japanese only, and are marked as such — we keep the original titles rather than translating them, so you can match what you find on the official site. Exam rules change; check the official page before you apply.

Related certifications

Back to all exam prep apps →

Our security policy, terms of use and privacy policy are published in Japanese.

Information security policyTerms & privacy