Japan bets on US cloud giants for defense data—but tightens control

Japan is embarking on a significant modernization effort by migrating highly sensitive defense and government data from traditional on-premises servers to commercial cloud services primarily offered by U.S. tech giants like Amazon and Google. This strategic shift, spearheaded by the Ministry of Defence with plans to secure funding in the fiscal 2027 budget, is also being considered by the Foreign Ministry and the National Intelligence Bureau, reflecting a broad government commitment to leveraging advanced cloud infrastructure.

Driving this migration is Japan’s ambition to integrate artificial intelligence within the Self-Defence Forces and other sectors, which demands the storage and processing of vast data volumes. The government aims to move specially designated secrets and critical economic security information to private-sector clouds, but this transition is carefully conditioned by sovereignty concerns to ensure that national security remains uncompromised amid the digital transformation.

To safeguard classified information in this new cloud environment, Japan’s National Cybersecurity Office is developing stringent security standards slated for completion by the end of the current fiscal year. These standards emphasize data center localization within Japan and restrict access exclusively to government-authorized personnel, underscoring a deliberate effort to balance cutting-edge technological adoption with robust cybersecurity and digital sovereignty.

Japan’s evolving cloud strategy encapsulates the complex interplay between embracing technological innovation and managing risks related to national security, digital sovereignty, and reliance on foreign cloud providers. This nuanced approach highlights ongoing challenges in applying domestic laws to classified data stored on foreign-operated platforms, reflecting a cautious yet forward-looking posture in Japan’s digital governance landscape.

Japan is strategically aligning its defense supply chain cybersecurity standards with those of the United States by embedding NIST SP 800-171 requirements into its defense acquisition regulations. This alignment ensures interoperability and shared security protocols between the two nations, reflecting a deepening bilateral trust and a commitment to harmonized defense-grade cybersecurity frameworks.

Fujitsu’s Trusted Supplychain Service, leveraging U.S. cybersecurity firm Exostar’s platform, exemplifies a practical solution to Japan’s stringent cybersecurity mandates. By operating entirely within Fujitsu’s domestic data centers certified under Japan’s ISMAP program, this service marries U.S. defense-grade security architecture with Japan’s strict data sovereignty requirements, ensuring sensitive defense information remains under national control while benefiting from proven American security technology.

Exostar’s platform, trusted by over half of the U.S. Defense Industrial Base and certified at FedRAMP Moderate Equivalency, brings critical security controls such as centralized identity management, multi-factor authentication, and audit-ready logging to the Japanese defense supply chain. Operating within a Microsoft GCC High environment, it creates a secure digital enclave that supports granular information-sharing policies, thereby enhancing transparency and trustworthiness across the transpacific defense collaboration.

Data sovereignty has transcended its traditional legal boundaries to become a pivotal infrastructure design consideration amid escalating geopolitical tensions and cyber threats. By early 2026, 96% of IT service providers incorporated geopolitical risks into their infrastructure strategies, recognizing that where data physically resides is only part of the equation. The UK's Information Commissioner's Office, for example, updated its international transfer guidance with a rigorous three-step test, underscoring the growing complexity of cross-border data flows and the need for organizations to embed sovereignty into their cloud architecture decisions.

True data sovereignty demands a nuanced understanding that extends beyond mere data residency to encompass legal jurisdiction, ownership, and operational control. As highlighted in Australia's experience, data stored domestically can still be subject to foreign legal reach under frameworks like the US CLOUD Act and bilateral agreements effective since January 2024, which allow authorities to compel data access regardless of physical location. Moreover, operational realities—such as support engineers accessing data from overseas—introduce additional jurisdictional exposures, revealing the limitations of relying solely on geographic data localization to ensure sovereignty.

Organizations often adopt hybrid cloud strategies that balance sovereignty with operational flexibility by retaining the most sensitive data within national borders under strict jurisdictional control, while leveraging global cloud platforms for less sensitive workloads. This approach is supported by infrastructure investments in certified, carrier-neutral data centers adhering to standards like ISO 27001 and 22301, which provide predictable governance and regulatory compliance. Additionally, operational redundancy through interconnected data centers ensures continuity and control amid geopolitical or cyber disruptions, reflecting a sophisticated, layered approach to sovereignty-sensitive infrastructure design.

The geopolitical nature of cloud infrastructure necessitates vigilance beyond technical capabilities to include ownership, control, and legal jurisdiction of providers, as these factors can shift rapidly and unpredictably. For instance, a data center in Brisbane may be Australian-owned one day but fall under foreign jurisdiction if acquired by an overseas entity, exposing data to new subpoena and intelligence laws without any physical relocation. As such, organizations must rigorously evaluate who owns and operates their technology, who can access their data, and under which jurisdictions providers operate to avoid 'sovereignty washing'—the false assurance that data residency equates to sovereignty.

Japan’s evolving cloud sovereignty strategy can draw heavily from Australia’s meticulous approach, which hinges on rigorous security scrutiny and comprehensive risk scenario planning when partnering with US-based cloud providers like AWS and Microsoft Azure. Australia’s success in hosting sensitive defense data stems from cultivating deep, bilateral trust frameworks that ensure transparency and accountability, thereby mitigating risks inherent in cross-border data management. This model underscores the necessity for Japan to not only enforce stringent cybersecurity standards but also to engage in continuous dialogue and joint oversight with US providers to safeguard classified information effectively.