Localizing compliance at scale: achieving South Korea’s ISMS certification

What it is

Cloudflare, Inc. holds South Korea's ISMS-P certification, issued after a ten-day audit by KISA-appointed auditors covering 80 controls. The post is most useful to two readers: vendor-risk reviewers who need to know how to verify coverage, and engineers building country-specific consent flows.

Verifying coverage in a vendor review

The certificate lists no products. Its Statement of Scope, submitted to KISA, defines a service boundary in three parts: the organizational and operational perimeter, the infrastructure perimeter, and the information assets and personal data flows. Cloudflare says a product is covered if it runs on the same certified platform, is operated by the same certified teams and is governed by the same ISMS. This differs from SOC 2 or ISO 27001, where coverage is confirmed by finding the product named in the report.

For a review, cite Cloudflare's entry on KISA's public register of certified organizations. Do not look for the product name on the certificate. The certificate is valid for three years, with an annual audit required to keep it. The legal basis is Article 47 of Korea's Act on Promotion of Information and Communications Network Utilization and Information Protection, with criteria in its Enforcement Decree and an MSIT public notification.

The page says ISMS sits alongside ISO/IEC 27001, 27701, 27017 and 27018 and does not replace them. It adds Korean legal requirements, assessed against the Personal Information Protection Act.

How the Korean sign-up flow decides

flowchart TD
    A[Sign-up request] --> B{IP country is KR?}
    B -- yes --> C[Itemized Korean form]
    B -- no --> D[Global combined form]
    C --> E{User-selected country}
    D --> E
    E -- Korea --> F[Itemized consent, no social login]
    E -- other --> G[Global flow]

The itemized form has four items: agree to all, plus three required items (terms of service, collection and use of personal information, limited overseas transfer) and one optional item (sharing with marketing third parties). The sign-up button stays disabled until all three required items are checked. Leaving the optional item unchecked only opts the user out of marketing.

Google, Apple and GitHub sign-up hand off to an identity provider and never show Cloudflare's form, so no itemized consent can be collected. Cloudflare chose to remove social sign-up in South Korea rather than build a separate post-authentication consent gate.

IP geolocation sets the default form. The page's example uses the country code from request.cf.country, the same value as the CF-IPCountry header. The country the user selects at sign-up overrides it, because IP location is an estimate and a Korean resident abroad or behind a VPN or carrier NAT may not arrive with a Korean address.

What the auditors required

• Data flow diagrams, not narrative descriptions, for every path by which employees can access personal information. Auditors tested each access control layer across internal systems, public websites, event pages and the dashboard, over the full data lifecycle from first interaction to destruction. The diagrams are not published.
• Scrutiny of consent wording, notification structure, and whether items were presented separately and clearly.

Caveats

The roughly year-and-a-half timeline came from audit cycles. An ISMS audit covers a single annual period, and preparation ran into a second one. That forced retranslation of policies, re-collection of evidence, a republished privacy policy, and rework after marketing and website design changes.

The post is Cloudflare's own account. It gives no control-level findings, no list of nonconformities and no audit dates.