Is Kuroco compliant with ISMAP (Information system Security Management and Assessment Program)?
Summary
ISMAP is a program that evaluates and registers cloud services (platforms). Kuroco runs on ISMAP-registered clouds depending on the deployment type, and you can choose a configuration that matches your requirements.
| Deployment type | Platform | Platform's ISMAP registration status | Notes |
|---|---|---|---|
| Public SaaS | GCP (with Fastly) | GCP is ISMAP-registered | Uses Fastly as CDN (not ISMAP-registered) |
| Private SaaS (Managed) | AWS | AWS is ISMAP-registered | Kuroco is deployed on AWS. Fastly (not ISMAP-registered) can be enabled or disabled ※1 |
| Private SaaS (Self-Hosted/BYOC) | AWS | AWS is ISMAP-registered | Kuroco is deployed on AWS. Fastly (not ISMAP-registered) can be enabled or disabled ※1 |
※1 When Fastly is not used, features dependent on Fastly (API caching, image optimization, etc.) are unavailable. Other CDNs can be used as alternatives.
- The public SaaS version of Kuroco is not registered with ISMAP as a SaaS.
- The private SaaS version of Kuroco is built on an ISMAP-registered platform, so it can be said to be ISMAP-compliant.
For a detailed comparison of each deployment type, including pricing and limitations, please also refer to the Deployment types section on the pricing page and Is an on-premises version available?.
Public SaaS Version
The public SaaS version runs on Google Cloud Platform (GCP), which is an ISMAP-registered cloud. Fastly, which is used as the CDN, is not registered with ISMAP, but since Fastly is used only as a CDN (Content Delivery Network) and is not a data storage location, there are generally no security concerns.
If a configuration using only ISMAP-registered services is strictly required, please consider the private SaaS version described below.
Fastly is a CDN (Content Delivery Network) and is not a data storage location. Fastly's role in Kuroco is API response caching and image optimization — it does not store information assets. As such, there are generally no security concerns in the context of ISMAP compliance. However, depending on procurement requirements, a separate review or application may be necessary.
Private SaaS Version
With the private SaaS version, Kuroco is deployed as software/middleware onto AWS (Amazon Web Services), which is an ISMAP-registered cloud. By selecting a configuration without Fastly, the entire system can be composed using only ISMAP-registered cloud services, so it is suitable for systems requiring ISMAP compliance.
By deploying Kuroco onto an ISMAP-registered platform (AWS) and composing the system using only ISMAP-registered services — for example, by not using Fastly — the setup can meet the requirements of systems requiring ISMAP compliance.
Managed (Infrastructure provided by Diverta)
- A private environment is built and Kuroco is installed in a dedicated sub-account for the customer within Diverta's AWS account
- Both configurations with and without Fastly are available
- For ISMAP compliance requirements, selecting a configuration without Fastly ensures the system is composed entirely of ISMAP-registered services
- Uses Fargate / Aurora / EFS / ElastiCache / S3 etc. with multi-AZ deployment on AWS
Self-Hosted (BYOC) (Infrastructure provided by the customer)
- Kuroco is installed in the customer's AWS account (a dedicated sub-account for Kuroco is recommended)
- Both configurations with and without Fastly are available
- For ISMAP compliance requirements, a configuration without Fastly can be selected
- ※Installation on clouds other than AWS (Azure / GCP) is available upon consultation
Limitations of the Private SaaS Version
Compared to the public SaaS version, the private SaaS version has the following limitations.
- When Fastly is not used: Features dependent on Fastly (API caching, image optimization, etc.) become unavailable. We are working on alternatives using other CDNs such as CloudFront.
- Log search screen: The log search screen that depends on BigQuery is unavailable. Logs are checked via CloudWatch (we are developing a log search screen that also works with CloudWatch).
With the private SaaS version, data is stored on AWS. By selecting a domestic region (e.g., Tokyo region), you can meet requirements such as "information assets must be stored within Japan."
Recommendations
- If ISMAP compliance is mandatory → Use the Private SaaS version (Managed or Self-Hosted) with a configuration that does not use Fastly. Kuroco is deployed on an ISMAP-registered platform, and the system can be composed entirely of ISMAP-registered services.
- If composing the system using only ISMAP-registered services is not mandatory → The public SaaS version also runs on ISMAP-registered GCP, and Fastly is used only as a CDN, so there are generally no security concerns
For details and pricing, please contact us through the link below.
Related documentation
Support
If you have any other questions, please contact us or check out Our Slack Community.