Cloudflare earns South Korea's ISMS certification: inside the 80-control audit

Hello, it's Shii-chan!

Cloudflare Blog blog.cloudflare.com

Today I read about Cloudflare earning South Korea's ISMS certification. The localization work behind it was surprisingly interesting!

What was announced?

The Cloudflare Blog shared that Cloudflare obtained South Korea's Information Security Management System (ISMS) certification under the ISMS-P framework. Auditors appointed by KISA worked through 80 controls over ten days.

Why it matters

ISMS is a localized standard covering security policy, access control, authentication, encryption, incident response, risk management, and disaster recovery, measured against how personal data moves and against Korea's Personal Information Protection Act.

The post stresses that controls were tested not just for existing, but for how they operate under Korean law and regulatory expectations.

What changes

ISMS adds Korea-specific legal and regulatory assurance on top of ISO/IEC 27001, 27701, 27017, 27018, and SOC 2. Customers can verify the certification on KISA's public register, and more privacy and compliance material is on the Cloudflare Trust Hub.

One caveat: the certificate names no products, and scope is defined by delivery path. Customers need to check whether a given product is delivered through the certified service.

Dive Deep

Sign-up for Korean users

The Korean flow appears based on the country selected or a South Korean IP address. Instead of one combined agreement, users see separate items:

• "모두 동의" (Agree to all)
• Required: Terms of Service
• Required: Collection and use of personal information
• Required: Transfer of a limited amount of personal information overseas
• Optional: Sharing a limited amount of personal information with marketing third parties

The sign-up button stays disabled until all three required items are checked. The optional item only controls marketing communications.

Why social sign-up was removed

Google, Apple, and GitHub sign-up hand users to an identity provider and skip Cloudflare's form, where the consent items appear. Cloudflare couldn't add a consent step to those third-party screens.

Rather than build a post-authentication consent gate for one country, it removed social sign-up for South Korea, so every account goes through the consent form.

Country detection

Cloudflare derives a two-letter country code from the client IP. It's available as the CF-IPCountry header at the origin and as request.cf.country in Workers. IP geolocation is only an estimate, and travelers, VPN users, and mobile carrier NAT users may not appear Korean, so the user's selected country overrides it.

Audit and scope

• Auditors required readable data flow diagrams of how employees access personal information (not published)
• They tested access controls across internal systems, public websites, event pages, and the dashboard, over the full data lifecycle
• They also reviewed consent wording and whether items were presented clearly and separately
• Preparation crossed into a second audit year, taking about a year and a half
• The certification is valid for three years, with an annual audit
• The certificate is held by Cloudflare, Inc.

Wrap-up

• KISA-appointed auditors reviewed 80 controls over ten days, and Cloudflare earned ISMS-P
• Korean sign-up separates three required consents from one optional one
• Social sign-up is disabled in Korea so every account sees the consent form
• Country is detected by IP, but the user's selection wins
• Scope follows delivery path, not a product list, so check the products you use

This one is for anyone operating in Korea, and for compliance folks!