Your business partners: "We can't work with
companies that haven't addressed security."
At the end of FY2026, Japan's new national system, the SCS evaluation system (Japan's security evaluation system for strengthening supply chains), gets under way.
In an era when small and medium-sized businesses can lose their business deals, the key is two-factor authentication.
Did you know that you cannot obtain ★3 without multi-factor authentication?
"We'll be fine": the companies that think so are the ones most at risk.
- You don't know how to answer the security checklist a business partner sent you
- You have antivirus software installed, so you assume there's no real problem
- Your passwords are complex, and you've made sure employees know the rules
- You use fingerprint or face authentication, so you consider two-factor authentication done
- You think, "A small business like ours isn't going to be targeted"
If even one of these applies to you, please read on.
At the end of FY2026, a new national system,
the "SCS evaluation system," begins.
The Ministry of Economy, Trade and Industry (METI) and the National Cybersecurity Office plan to launch the SCS evaluation system around the end of FY2026. This new system evaluates the level of security measures across the entire supply chain against common criteria.
Under this system, a company's level of security measures is evaluated on two levels, ★3 (basic measures) and ★4 (comprehensive measures), and large companies and government agencies will begin to require their business partners to obtain these stars.
Small and medium-sized businesses that are part of manufacturing supply chains
Companies responsible for logistics and parts supply
Professional firms (lawyers, accountants, tax accountants, etc.) and accounting offices that do business with large companies and government agencies
All businesses that handle personal information
What is the SCS evaluation system?
- Built and operated by METI and the National Cybersecurity Office
- The government issues ★3 and ★4, much like ISO certification (it is not a "rating system")
- ★3 is a self-assessment confirmed by an expert; ★4 is a third-party assessment plus technical verification
- All industries are covered, and small and medium-sized businesses in particular need to act urgently
"Our own company has taken measures" is no longer enough.
From now on, ordering companies and prime contractors will be expected not only to secure their own company, but also to check and promote the security measures (such as two-factor authentication) of all their business partners and subcontractors. Whether the entire supply chain is protected, and whether you are driving that forward, will be questioned more than ever before.
Many companies have it "wrong":
are you making the same mistake?
"We have antivirus software, so we're fine"
Antivirus software is a tool that works "after an intrusion." It only starts working once an attacker has cracked a password and got inside. In other words, the entry point is left wide open.
"Our passwords are complex, so we're fine"
However complex a password is, it is useless once it leaks. Leaks happen outside the user's control (phishing, leaked credential lists, insider wrongdoing, and so on).
81% of hacking-related breaches used stolen or weak passwords — Verizon DBIR 2017
More than 90% of unauthorized access cases cleared by police in Japan involved misuse of another person's ID and password — National Police Agency / Ministry of Internal Affairs and Communications / Ministry of Economy, Trade and Industry (METI), "Status of Unauthorized Computer Access" (2023)
"Fingerprint and face authentication give us two-factor authentication"
Fingerprint or face authentication added after the fact to a standalone PC "simply replaces the Windows password with a fingerprint or face." The internal mechanism is the same as password authentication, and it is not two-factor authentication. Under the standards of NIST in the United States, too, a face or fingerprint by itself is not counted as an authentication "factor." Ransomware attackers target the misconception that "biometrics = two-factor authentication."
"We use two-factor authentication for each tool, so we're fine"
Many companies set up two-factor authentication for Salesforce or Microsoft 365, but if the PC itself is compromised, the tools' two-factor authentication means nothing. That is because an attacker inside the PC can directly operate tool screens that are already logged in. What needs protecting is not authentication for each tool, but the PC login itself.
Your company is already being targeted.
Cyberattack-related communications that reached NICT's observation network (number of packets / year)
"Nothing has happened to us." If that's how you feel, it may just be that you haven't noticed.
What happens if things stay as they are?
Turned away at the door
In deals with large companies or government agencies, the moment you write "multi-factor authentication: not implemented" on the security checklist, the negotiation stops. Once the SCS evaluation system is in force, your ★3/★4 status will be asked about directly, and companies that have not addressed it will not even get a seat at the table.
Existing business suspended
If your measures are judged "insufficient," a business relationship of many years can suddenly be suspended. Risk management across entire supply chains is being tightened.
Ransomware damage and loss of trust
If data is leaked or encrypted, the fact that "you neglected to take measures" is fatal. Of 222 ransomware cases, 140 (about 63%) involved small and medium-sized businesses (National Police Agency, 2024). Restoring trust takes an enormous amount of time.
applippli-key is the "last line of defense" for preventing these three scenarios before they happen. From a single PC and in as little as 5 minutes, you can put in place a setup that lets you answer your business partners' security requests with "multi-factor authentication: implemented."
The solution is simple:
"use two keys." That is two-factor authentication.
Even in cases where the ID and password had already been leaked, multi-factor authentication was reported to reduce the risk of compromise by 98.56% (a 99.22% reduction overall).
https://arxiv.org/abs/2305.00945
Microsoft also states on its own security blog that multi-factor authentication can block over 99.9% of account compromise attacks (“MFA can block over 99.9 percent of account compromise attacks.”).
Source: Microsoft Security Blog, "One simple action you can take to prevent 99.9 percent of attacks on your accounts" (August 20, 2019)
https://www.microsoft.com/en-us/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/
"Implementation of multi-factor authentication" is a mandatory item for obtaining ★3. In other words, you cannot obtain ★3 without multi-factor authentication. For small and medium-sized businesses that want to keep doing business with large companies, it is a measure that cannot be avoided.
applippli-key is a product that delivers this "two-factor authentication" with just the smartphone you already have. It works with the dedicated app "applippli Authenticator" to add a second key to Windows login. You can log in with just a one-touch on your smartphone, and even if the PC is offline, you can log in with a six-digit one-time password that changes every 30 seconds. With no complex setup and no additional equipment, it addresses the multi-factor authentication item in the ★3 requirements (evaluation criterion 4-1-3).
In fact, you can start right now.
Small and medium-sized businesses choose applippli-key because it has thoroughly pursued three things: "simple, easy and low-cost." It is not about advanced features or complex operation; it is designed so that the people who need it can use just the measures they need, right away.
🎯 PILLAR 01: Simple
It implements only the minimum, simple features needed: one-time password settings, emergency logon, and login history. There are none of the "features nobody uses" that multifunction tools tend to have.
⚡ PILLAR 02: Easy
It can be introduced easily without specialist knowledge. Just follow the setup wizard and click the buttons, and you can be up and running in as little as 5 minutes.
💰 PILLAR 03: Low-cost
Available from a single PC, with no minimum contract period and no add-on options. Clear pricing that is easy for small and medium-sized businesses to budget for, and you are free to cancel at any time.
Up and running in 3 steps
Install
Click through the setup wizard. About 2 minutes.
One-time password settings
Set the recovery key and emergency logon. About 1 minute.
Link the smartphone app
Just scan a QR code. About 2 minutes.
Plus, 5 features ideal for small and medium-sized businesses
POINT 01: Setup in 5 minutes
No complex installation work and no long waits. You can start using it the same day.
POINT 02: No special equipment needed
All you need is the smartphone you already have. No need to buy expensive dedicated devices.
POINT 03: Works without the internet
The authenticator app works offline. You can log in even where there is no signal.
POINT 04: Available from a single PC
Try it on a small scale in some departments first and confirm the results. Supports a small start.
POINT 05: Supports all Windows versions
Broad support, from Windows 10/11 to Windows Server 2016–2025.
Do you have concerns like these?
I'm not very familiar with IT, so setup sounds difficult...
Won't it cost a lot to introduce?
I'm worried whether our employees will be able to use it.
If an employee forgets their smartphone, won't work grind to a halt?
Can it be used to comply with the SCS evaluation system?
We already use two-factor authentication for tools such as Salesforce. Do we need this as well?
Does it support macOS?
Does it also support two-factor authentication for routers and VPN devices?
If we show the applippli-key screen (one-time password entry) during an information security audit, won't auditors think it isn't two-factor authentication?
Unlike two-factor authentication for individual services (such as Cybozu or Salesforce), applippli-key is distinctive in that it applies two-factor authentication to the "entry point" itself: the OS login. Whether you show the one-time password entry screen or the one-touch login on a smartphone, the fact remains that authentication uses two different factors, "knowledge on the PC itself (the password)" and "possession (the smartphone)," and it can be confirmed and accepted as two-factor authentication (multi-factor authentication) in an information security audit.
We also offer a mode of operation in which the Windows password is not typed at all (one-touch login). This is an improvement that removes the user's effort every time and eliminates the biggest risk itself, password leakage. Internally, the same two-factor authentication mechanism as before continues to work securely; the number of factors has not been reduced.
applippli-key is not a cost but
"an investment that generates sales and profit"
Security measures are not an expense. They are an investment that maintains your business partners' trust and keeps deals moving. If you are judged not to meet ★3 under the SCS evaluation system and a deal stops even once, the loss will be many times the cost of introduction. applippli-key is a move that prevents risk while protecting and growing your company's sales and profit.
The SCS evaluation system takes effect at the end of FY2026:
whether you act now will decide your future.
▶ NOW / The future for companies that act now
- - Become a company that gets chosen
- - Earn business partners' trust early
- - Pass security checks smoothly
- - Be chosen as "a partner that can be trusted with the work"
- - Already meet the requirements when obtaining ★3
- - A clear differentiator from competitors
▶ LATER / The future for companies that put it off
- - End up on the side whose business stops
- - Sudden suspension of business and stalled deals
- - The fatal judgment of "insufficient measures"
- - Enormous cost and time to restore trust
- - Miss the system's launch and lose business opportunities
- - Lose business to competitors in the same industry
Why not take that first step with applippli-key? From a single PC and in as little as 5 minutes, it protects your company's Windows login with two-factor authentication.