Achieving South Korea's ISMS Certification: Cloudflare's Localization Journey

Achieving South Korea's ISMS Certification

Cloudflare has obtained South Korea's Information Security Management System (ISMS) certification under the ISMS-P framework. The process involved auditors appointed by the Korea Internet & Security Agency (KISA) working through 80 controls over a ten-day period with the United States-headquartered company. For customers in South Korea, this certification serves as evidence that Cloudflare's security and privacy programs operate effectively within the context of Korean law, the Korean language, and local regulatory expectations.

Adapting Sign-Up and Consent Flows

The most visible change resulting from this compliance effort is the Cloudflare account sign-up page for users in South Korea. The experience is triggered by the country selected at sign-up and IP geolocation. The agreement terms are divided into four separately labeled items: three required items covering Terms of Service, collection and use of personal information, and overseas transfer of a limited amount of personal information; and one optional item regarding sharing personal information with marketing third parties. The sign-up button remains disabled until all three required consents are checked. To comply with these rules without bypassing the form through identity providers like Google, Apple, or GitHub, Cloudflare removed social sign-up paths for users in South Korea, ensuring every account creation goes through the compliant sign-up form. While IP geolocation helps determine the default form, user selection overrides it to ensure consent is accurate and meaningful.

Audit Scope and Regulatory Framework

ISMS is a detailed, localized certification standard covering security policy, access control, authentication and permission management, encryption, incident response, risk management, and disaster recovery. It aligns with Korea's Personal Information Protection Act and is established under Article 47 of Korea's Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. The certification requires an independent audit by KISA-appointed auditors and review by a special committee, remaining valid for three years with mandatory annual audits. Cloudflare's audit involved detailed data flow diagrams examining access control layers across internal systems, public-facing websites, event pages, and the Cloudflare dashboard.

Service Boundary and Procurement Implications

Unlike SOC 2 or ISO 27001 reports that list specific products, KISA defines the certified scope as a service boundary comprising an organizational and operational perimeter, an infrastructure perimeter, and information assets and personal information flows. Any product delivered through this certified service boundary is covered by the certificate held by Cloudflare, Inc. This provides legal, security, and procurement teams with a localized assurance benchmark. Cloudflare's entry is available on KISA's public register of certified organizations, and additional materials are located on the Cloudflare Trust Hub.