Cloudflare Says It Obtained South Korea’s ISMS Certification
Summary
Cloudflare says it obtained South Korea’s ISMS certification after a KISA-appointed audit. It describes localized consent requirements, audited data flows and access controls, and a service-boundary approach to defining certificate coverage.
Key points
- Cloudflare says a KISA-appointed audit reviewed 80 controls over ten days before the company obtained South Korea’s ISMS certification.
- For South Korean sign-ups, Cloudflare separates consent into four items; three are required, and social sign-up is unavailable so users pass through the consent form.
- The sign-up experience uses IP geolocation and the selected country, with the selected country overriding the IP-based default.
- Auditors examined data-flow diagrams and tested access-control layers across internal systems, websites, event pages, and the Cloudflare dashboard.
- The certification scope follows the service boundary and delivery path rather than listing covered products by name.
- Cloudflare says the certification is valid for three years and requires an annual audit to maintain.
Article Details
- Event Type
- Security and privacy compliance certification
- Impact
- Cloudflare obtained South Korea’s ISMS certification under the ISMS-P framework after an audit covering 80 controls. The certification provides a Korea-specific assurance benchmark for customers; its scope is defined by the certified service boundary rather than a product list. Cloudflare also changed South Korean sign-up flows so required consent is collected through its own form, with social sign-up unavailable in South Korea.