Certification scope: boundary-based rather than product-listed

Cloudflare, Inc. now holds South Korea's Information Security Management System (ISMS) certification, awarded under the country's ISMS-P framework. KISA records the certified scope as a service boundary, not a roster of covered products. The Statement of Scope filed with KISA defines that boundary along three lines:

  • Organizational and operational perimeter: the entities, teams and processes that run the service.
  • Infrastructure perimeter: the network and platform on which the certified service runs.
  • Information assets and personal information flows: whatever falls inside the boundary under the ISMS control set.

A customer-facing product is therefore in scope when it is delivered through that certified service boundary — same platform, same operating teams, same ISMS — whether or not it appears by name anywhere. Procurement teams used to checking SOC 2 and ISO 27001 reports will notice the difference: those documents list the services they cover, so coverage is confirmed by locating the product in the list. The ISMS certificate carries no such list, and coverage is traced through the delivery path instead.

The most visible outcome sits on the account sign-up page. Where the global form carries a single line — "By continuing, I agree to Cloudflare's terms, privacy policy, and cookie policy." — a visitor from South Korea sees the agreement split into separate labeled items, each tagged required or optional, each linked to its full text, plus a single agree-to-all option:

  • 모두 동의 (Agree to all)
  • [필수] 서비스 약관 ([Required] Terms of Service)
  • [필수] 개인정보 수집 및 이용 ([Required] Collection and use of personal information)
  • [필수] 제한된 범위의 개인정보 해외 이전 ([Required] Transfer of a limited amount of personal information overseas)
  • [선택] 제한된 범위의 개인정보 제3자 제공 ([Optional] Sharing a limited amount of personal information with marketing third parties)

The three required items are hard gates: the sign-up button remains disabled until each has been checked, so no account is created without an affirmative action on all three. Only the optional item governs marketing permission; leaving it unchecked has no bearing on account creation and simply opts the user out of marketing communications.

Where the country signal comes from

The Korean experience is triggered by the country chosen at sign-up and by IP geolocation within South Korea. The geolocation input is available to any Cloudflare customer: a two-letter country code derived from the client IP, exposed as the CF-IPCountry header at the origin and as request.cf.country inside a Worker. At its core the branch is a string comparison:

// Illustrative: the shape of the check, not Cloudflare's own dashboard code.
export default {
  async fetch(request) {
    // Two-letter country code derived from the client IP.
    // Same value as the CF-IPCountry request header.
    // Cloudflare's network populates this on the incoming request, so there is
    // no geolocation database, lookup service, or extra round trip of our own.
    const country = request.cf?.country;

    if (country === "KR") {
      return renderSignUp({
        locale: "ko-KR",
        consent: "itemized",  // four separate items, three of them required
        socialLogin: false,   // no path that skips the consent form
      });
    }

    return renderSignUp({ locale: "en-US", consent: "combined", socialLogin: true });
  },
};

The country code is deliberately not the sole trigger. IP geolocation is an estimate: addresses rotate, ownership changes, and for use cases critical to a local requirement it should not be the only signal. A Korean resident abroad, or someone behind a VPN or a mobile carrier's NAT, may arrive without a Korean address. IP geolocation therefore decides which form renders by default, while the country a user selects at sign-up overrides it and carries the decision onward. The IP address reports where a request came from; only the user can report where they reside.

The sign-up paths that skip the form

Itemizing consent on a form Cloudflare controls was the straightforward part. The hard part was the flows that never render it. Google, Apple and GitHub sign-up hand the user to an identity provider and return with an authenticated identity, bypassing the form where the four items live — and there is no point in that handoff for presenting three required items with links to their Korean text. The provider's screen cannot be modified.

The choice was between a separate post-authentication consent gate for one country and removing the paths that skip the existing gate. Cloudflare took the second option: social sign-up is not offered in South Korea, so every account created there passes through the sign-up form and its enforced consents.

What the auditors examined

Auditors appointed by KISA sat with the company for ten days and worked through 80 controls. Certification rests on an independent audit followed by review from a special committee, is valid for three years and requires an annual audit to maintain. It is established primarily under Article 47 of Korea's Act on Promotion of Information and Communications Network Utilization and Information Protection, etc., with criteria and procedure set out in the Enforcement Decree and in MSIT's public notification on ISMS certification. Assessment covers security policy, access control, authentication and permission management, encryption, incident response, risk management and disaster recovery, measured against how personal data actually moves through systems and against Korea's Personal Information Protection Act and related guidelines.

Cloudflare already holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27017 and ISO/IEC 27018, among other certifications; ISMS replaces none of them. It localizes the same principles and layers Korean regulatory requirements on top — which shifts both what auditors seek and how they seek it.

Review began with data flows. Cloudflare supplied diagrams of every path by which employees can reach personal information it collects, processes and stores. The flows are not Korea-specific; the required evidence format was. Auditors would not work from a narrative account of data movement and wanted diagrams they could read and interrogate, then examined each access control layer and tested its effectiveness across internal systems, public websites, event pages and the Cloudflare dashboard, following a user's data from first interaction to destruction. The diagrams themselves are withheld as confidential.

The audit also went through the wording and structure of consent collection: the exact sign-up text, each notification's layout, and whether items were presented separately and clearly.

Why preparation took a year and a half

Some of the duration is inherent to audit cycles. An ISMS audit covers a single annual period, and all evidence, documentation and systems must reflect that period. Preparation ran past one audit year into the next, which forced a retranslation of updated policies for the new year, fresh evidence collection and assessment, republication of the privacy policy, and absorption of formatting and design changes introduced by marketing and website teams in the interim.

Reading the certificate in a risk review

For organizations operating in Korea, the certificate gives legal, security and procurement teams a local assurance benchmark sitting alongside the broader compliance portfolio. ISO/IEC 27001 and SOC 2 speak to general security posture; ISMS reflects Korea-specific legal and regulatory expectations — a distinction that matters in third-party risk reviews and in a team's own compliance assessments. Cloudflare's entry appears in KISA's public register of certified organizations, the independent confirmation to cite. Additional privacy and data protection material is on the Cloudflare Trust Hub.

The usual sticking point in vendor review — whether a particular product is in scope — is answered by boundary rather than by name, since the certificate names no products. ISMS is not a stricter audit than the others, but a more nuanced one, built around one region's regulatory needs and demanding genuine investment in embedding them rather than mapping them onto a common control framework.