CLOUDFLARE has obtained South Korea’s ISMS certification under the ISMS-P framework, following a ten-day audit with auditors appointed by the Korea Internet & Security Agency (KISA) and a review of 80 controls. The certification signals that Cloudflare’s security and privacy programme has been assessed not only for the existence of controls but for how they operate within Korean law, language and regulator expectations. ISMS certification runs for three years and requires an annual audit to maintain it.
The audit scope is defined by three boundaries: the organisational and operational perimeter, the infrastructure perimeter, and the information assets and personal data flows within the ISMS control set.
A key practical impact for Korean users is visible during sign-up. Where users in other regions see a combined consent prompt, Korean sign-ups present four itemised consents, three of them required, with the sign-up button disabled until each is acknowledged. Cloudflare also eliminated social sign-up paths in South Korea to ensure this consent gate is always shown. The company notes IP geolocation via the CF-IPCountry header informs the default sign-up path, but that user-declared residence can override it.
The audit focused on data flows, access controls, and the exact language and structure of consent notices, requiring read-worthy diagrams and tangible verification of controls across the full data lifecycle. The certificate’s coverage is delivered through the certified service boundary rather than a product list, meaning eligibility depends on data flow and delivery path rather than named products. Cloudflare emphasises that ISMS complements existing frameworks like ISO/IEC 27001 and SOC 2, reflecting Korea-specific regulatory expectations.