Cloudflare obtains South Korea's ISMS certification after 10-day audit of 80 controls

Cloudflare has obtained South Korea's Information Security Management System (ISMS) certification under the ISMS-P framework, following a 10-day audit by KISA-appointed auditors covering 80 controls.
To meet Korean consent requirements, Cloudflare disabled social sign-up (Google, Apple, GitHub) for users in South Korea, forcing all accounts to use a localized form with three required and one optional consent items.
The certification is valid for three years with mandatory annual audits and is based on a service boundary rather than a list of specific products, covering any Cloudflare service delivered through the certified platform.
The audit process took approximately 1.5 years due to the need to re-collect evidence and update policies across multiple audit cycles, distinct from global frameworks like ISO/IEC 27001 which Cloudflare also maintains.

Compliance Mechanics

Korean users see a sign-up page triggered by IP geolocation and country selection, breaking agreements into four separate items: Terms of Service, personal information collection, overseas transfer, and optional third-party sharing.
The sign-up button remains disabled until the three required items are checked, ensuring affirmative action for each consent gate.
IP geolocation (CF-IPCountry header) determines the default form, but the user's selected country overrides this signal to ensure consent reflects residence rather than just request origin.

Auditors examined data flow diagrams, access control layers, and the specific language of consent notifications, requiring visual diagrams rather than narrative descriptions.
The certification is established under Article 47 of Korea's Act on Promotion of Information and Communications Network Utilization and Information Protection.
Coverage is determined by the delivery path: if a product runs on the certified platform and is operated by certified teams, it falls within the ISMS scope.