ISMS-P Certification (2026): Who Must Certify, Application Steps, and Costs
Every year at the start of the year, one question never fails to land in an information security officer’s inbox: “The CEO is asking—do we need ISMS-P too?” And surprisingly few practitioners can answer that with a straight yes or no. Revenue, user counts, and industry conditions are intertwined, and failing to certify doesn’t just mean a fine of up to KRW 30 million—in large-enterprise and public-sector bids, not holding the certification often means losing the contract.
📌 Besides mandatory-status determination, the application process, timeline, and cost, this article now covers representative controls and evidence across the three domains, recurring findings, a per-domain self-check, and post-certification follow-up and renewal audits in one place (revised 2026-10-06).
This article aims to give immediate answers—from “are we in scope?” to “what to prepare, when, and at what cost”—using tables, a timeline, and checklists. Even scanning the tables should give you a clear direction.
⚠️ Don’t confuse this with CSAP
- ISMS-P: Certifies an organization’s information security and personal information protection management system (KISA / Korea Internet & Security Agency)
- CSAP: Certifies the security level of the cloud service itself (a condition for using public-sector cloud) The two differ in both scope and legal basis. “We use the cloud, so isn’t CSAP enough?” is a misconception.
📌 Figures below are general 2026 baselines. Always confirm actual applicability against the latest notices and KISA guidance (ISMS-P portal).
1. Are We in Scope? — Decision Criteria Table
Mandatory ISMS certification under the Information and Communications Network Act can be summarized as follows.
| Category | Mandatory condition | Decision point |
|---|---|---|
| ISP | Information and communications network service provider under the Telecommunications Business Act (owns circuit facilities) | Provides service in Seoul and all metropolitan cities |
| IDC | Integrated information and communications facility (data center) operator | Operates facilities for others to provide information and communications services |
| Revenue threshold | KRW 10 billion or more in prior-year revenue from the information and communications services segment | Segment revenue, not total company revenue |
| User threshold | Daily average of 1 million or more users over the three months immediately preceding the prior year-end | DAU basis; confirm how unique visitors are counted |
| Hospitals | Tertiary general hospitals with annual revenue of KRW 150 billion or more | Special rule for medical institutions |
| Universities | Universities with 10,000 or more enrolled students | Schools under the Higher Education Act |
If any one of the above applies, you are an ISMS mandatory subject. If you also process personal information (most organizations do), obtaining ISMS-P, which includes the personal information protection domain, is the more practical choice.
ISMS vs. ISMS-P — how to choose
- ISMS: Information security management system only. Meets the minimum mandatory requirement.
- ISMS-P: Information security plus personal information processing stages. Recommended for organizations that handle large volumes of personal information or face elevated personal-data risk (MyData, AI training data, etc.).
Even if you are not in mandatory scope, voluntary application is allowed, and organizations increasingly pursue it for bid scoring, customer requirements, and external trust.
2. From Application to Certificate Issuance — Stage-by-Stage Timeline
Including preparation, plan for at least 6 months, typically 8–12 months.
| Week (cumulative) | Stage | What practitioners need to do |
|---|---|---|
| 0–12 weeks | Gap analysis and management system build-out | Update policies and guidelines, perform risk assessment, collect evidence per control |
| 12–20 weeks | Operations and evidence accumulation | Accumulate at least 2 months of actual operating logs and records (paper-only setups get findings) |
| Week 20 | Submit application | Finalize certification scope, submit official letter, pay fees |
| Weeks 21–22 | Preliminary review | Audit team checks readiness and gives advance feedback on gaps |
| Weeks 23–24 | Audit team formation and initial audit (document + on-site) | Staff interviews, system walkthroughs, on-site inspection response |
| Weeks 25–29 | Remediation of findings (up to 100 days) | Remediate against the findings report, then submit a remediation report |
| Weeks 30–33 | Certification committee review | Prepare additional supporting materials |
| Week 34 onward | Certificate issued | 3-year validity begins; register follow-up audit schedule |
The critical piece is the “operating period.” Writing policies is not enough—you need at least 2–3 months of logs, meeting minutes, and inspection records showing those policies actually ran.
Key deliverables by preparation stage
| Preparation stage | Key deliverables |
|---|---|
| Current-state analysis and scoping | Information asset inventory, service/organization overview, gap analysis results |
| Policies and guidelines | Information security policy, guidelines and procedures, security committee charter |
| Risk assessment | Risk assessment report, DoA (acceptable risk level) approval record |
| Applying protection measures | Protection measure implementation plan, control evidence |
| Internal audit and training | Internal audit report, staff training completion records |
| Application | Application form, statement of applicability, at least 2 months of operating evidence |
3. Three-Domain Checklist — Structure of the 101 Certification Criteria
As of 2026, ISMS-P criteria fall into three domains.
| Domain | Number of controls | Key inspection items |
|---|---|---|
| 1. Establishment and operation of the management system | 16 | Policy establishment, designation of senior officer (CISO/CPO), risk management, internal audit and improvement |
| 2. Protection measure requirements | 64 | Access control, encryption, authentication and authorization, physical security, incident response, backup, vulnerability assessment |
| 3. Requirements by personal information processing stage | 21 | Collection, use, provision, outsourcing, destruction; data subject rights |
| Total | 101 | ISMS covers domains 1 and 2 (80 items); ISMS-P covers all three |
The protection measure requirements are the largest domain at 64 items, so they take the most preparation effort. The area breakdown (1.1–1.4, 2.1–2.12, 3.1–3.5) is published on the ISMS-P portal criteria page and in the PIPC guidance.
Representative controls by area and the evidence to prepare
| Area | Representative control | Evidence auditors look for |
|---|---|---|
| 1.1 Management system foundation | 1.1.1 Management participation | Security committee minutes, management approval records |
| 1.2 Risk management | 1.2.1 Asset identification, 1.2.3 Risk assessment | Asset inventory, risk assessment report, DoA approval record |
| 1.4 Management system review and improvement | 1.4.2 Management system review | Internal audit plan and report, corrective actions |
| 2.3 Third-party security | Third-party inventory, contracts, compliance checks | Outsourcing inventory, contracts with security clauses, processor inspection results |
| 2.5 Authentication and authorization | Access-rights review | Access request/approval log, periodic review results |
| 2.7 Encryption | Applying the encryption policy | Encryption policy, list of at-rest/in-transit encryption coverage |
| 2.9 System and service operations | Log and access-record management and review | Access-record retention settings, periodic review records |
| 3.3 Protection when providing personal information | Third-party provision, disclosure of outsourcing | Provision/outsourcing inventory, privacy-policy updates |
| 3.4 Protection at destruction | Destruction of personal information | Destruction log, destruction certificates |
| 3.5 Data subject rights | Publishing the privacy policy | Privacy-policy revision history, reconciliation against actual processing |
For item-level checks, use the certification criteria guide and detailed checklist published by KISA. Evidence has to be dated records, not a statement that "we manage it."
2026 Certification Criteria Guide: What Changed and Official Links
As of October 15, 2026, the latest certification criteria guide posted on KISA's ISMS-P site and Korea's Privacy Portal is the November 2023 revision. It reflects the Personal Information Protection Act and Enforcement Decree amendments in force since September 15, 2023, plus changes to the detailed check items; the 101-criteria structure in this article follows it. No 2026 edition of the criteria guide has been posted yet.
What changed in 2026 is the reform plan, not the guide. On April 10, 2026, the Personal Information Protection Commission and the Ministry of Science and ICT announced a plan to strengthen the effectiveness of ISMS/ISMS-P certification.
| Area | What was announced | Target |
|---|---|---|
| Scope and criteria | Mandatory ISMS-P certification for critical personal-data processing systems; a three-tier system (enhanced, standard, simplified) | 2027 |
| Audit method | Shift from document-based to on-site, evidence-based audits; stronger technical testing such as penetration tests and vulnerability assessments | No separate date announced |
| Post-certification | Continuous checks, audits paused after breaches, certification revoked if major findings aren't fixed | H2 2026 |
| Audit quality | Trust surveys of audit bodies, reflected in their designation reviews | No separate date announced |
The exact mandatory scope and the new criteria will be set by amendments to the Enforcement Decree and the official notice. If you are preparing now, prepare against the current 101 criteria, then check the differences once the new notice and guide are published.
Official links
- KISA ISMS-P site: criteria guide (2023.11), detailed check items, certification system guide (2024.07)
- Privacy Portal: ISMS-P certification criteria guide (Nov 2023 revision)
- PIPC press release: certification effectiveness plan (2026-04-10)
4. Recurring Audit Findings TOP — Causes Matched 1:1 with Countermeasures
Knowing why something becomes a finding makes it easier to prepare.
| Recurring finding | Why it is a finding | How to prepare in advance |
|---|---|---|
| Inadequate access-rights review | Terminated-employee accounts and excessive privileges left in place | Keep records of quarterly access-rights recertification |
| Log review not performed | Logs are collected but there is no evidence they were reviewed | Produce periodic log-review meeting minutes and checklists |
| Personal information not destroyed | Data past its retention period not deleted | Maintain destruction target lists and destruction confirmation records |
| Risk assessment done as a formality | Same assets and same risks copied year after year | Reflect actual asset changes; document DoA rationale |
| CISO/CPO designation or filing missing | Statutory filing obligation not met | After designation, confirm filing with the competent authority is complete |
| Weak third-party / processor management | Outsourcing contracts lack security clauses; no inspections | Annual processor status review; control of sub-processing |
| Vulnerability findings not remediated | Assessment done, remediation not done | Evidence a closed loop: assess → remediate → re-assess |
| Asset inventory out of date | New servers or SaaS missing from the inventory | Tie asset registration/retirement to change management |
| Encryption policy not applied | Plaintext storage or weak settings despite the policy | Periodically check the at-rest/in-transit coverage list |
| Privacy policy not kept current | Outsourcing/third-party changes missing from the policy | Revise the policy whenever processing changes |
| Policy and practice diverge | Documents exist but no operating records | Rewrite policies to what you can actually run, then accumulate records |
| Internal audit as a formality | Only "no issues" recorded | Checklist-based audits with findings and corrective actions recorded |
If you use the cloud: document the split of responsibilities
"Our cloud provider is certified, so our scope is covered" is not true. Underlying infrastructure such as physical security and the hypervisor is the provider's responsibility, but the areas you configure yourself — accounts and permissions (IAM), network access settings, encryption settings, log collection — fall within your management system.
- When setting the certification scope, split provider and customer responsibilities in a table (RACI or similar).
- Collect the provider's certificates and reports (ISMS, ISO/IEC 27001/27017, etc.) as third-party (outsourcing) management evidence.
- Evidence your own areas with configuration screenshots, policies, and log-retention settings.
5. Duration and Cost Estimates, and In-House vs. Consulting
Audit fees are based on the number of audit days (auditors × days), which depends on the size of the certification scope. Check the calculation method in KISA's published fee calculation sheet and the related notice, and get an exact quote before applying. Consulting and tooling costs vary too widely with your current maturity and scope to state a figure here. When comparing quotes, include internal staff time in the cost.
Self-check: do you need consulting? (2 or more Yes → consulting recommended)
- Dedicated information security staff of 1 or fewer
- No prior ISMS/ISMS-P experience in the organization
- Never drawn a personal information processing flow diagram
- Difficult to establish a risk assessment methodology in-house
💬 Prep tip: Even if you prepare the first certification with consultants, the in-house owner has to explain your management system to the auditors. Get outside help with documents if you need it, but make sure internal staff can run and explain the operations. You can outsource the documents; you must internalize the operations.
6. If You Already Hold ISMS — Expanding to ISMS-P
If you already hold ISMS, you do not need to start over.
- You can expand to ISMS-P by adding an audit of the personal information processing stage (21 criteria) only
- Aligning the expansion audit with re-audit or renewal reduces audit burden and cost
- Validity remains 3 years, maintained with one follow-up audit per year
- Follow-up audits check whether prior findings remain remediated, so findings history management is critical
In 2026, with Personal Information Protection Act amendments and the spread of MyData, domain 3 audits are tightening—so even ISMS-only organizations should start considering a P expansion.
7. After Certification: Follow-up and Renewal Audits, and an Annual Evidence Calendar
The certificate is valid for 3 years, with a follow-up audit every year and a renewal audit before expiry. Follow-up audits check that earlier findings stay remediated and that the management system keeps running. Records produced in a rush right before an audit tend to give themselves away because their dates and contents don't match the actual operating cycle, so the point is to let evidence accumulate on its normal schedule.
| Cycle (example) | Recurring activity | Evidence to keep |
|---|---|---|
| Monthly | Backup checks, patch status review, access-record review | Backup check log, patch history, access-record review sheet |
| Quarterly | Access-rights review, reclaiming unused accounts | Access review results, account reclamation log |
| Semi-annually | Vulnerability assessment, incident-response drill | Assessment results and remediation, drill report |
| Annually | Risk assessment, security and privacy training, internal audit, processor inspections | Risk assessment report, training roster, internal audit and processor inspection results |
The cycles are examples. Run them as defined in your own policies; auditors check whether the cycle written in the policy matches the actual records.
2026 reform direction: On 2026-04-10 the Personal Information Protection Commission and the Ministry of Science and ICT announced measures to strengthen the effectiveness of ISMS/ISMS-P certification (PIPC press release). Highlights: ▲mandatory ISMS-P for major public-system operators, mobile carriers, identity verification agencies, and large personal-information processors, expanding in stages; ▲a three-tier scheme (enhanced, standard, simplified); ▲pre-checks of core items at the preliminary audit stage (the CISO/CPO's authority over policy, identification of assets that process personal information or face the internet, password and encryption controls, vulnerability and patch management) plus technical audits with vulnerability scanning and penetration testing; ▲standardized periodic check forms with focused follow-up audits, and certificate revocation when serious findings are not remediated in time. Timing and detailed criteria will be set by follow-up amendments to laws and notices, so check the latest announcements before applying.
Kickoff Checklist
- Determine mandatory status using information and communications services segment revenue and user counts
- Decide ISMS vs. ISMS-P (consider volume of personal information processed)
- Confirm certification scope and CISO/CPO designation and filing
- Run a gap analysis and identify deficient controls
- Plan 2–3 months of operating evidence accumulation
- Use the consulting self-check to decide in-house vs. external
- If you use the cloud, prepare a responsibility matrix and collect the provider's certificates
- Put the annual evidence calendar on the team schedule
Self-check by domain (tick when you have the evidence)
[Management system establishment and operation]
- There are records of decisions with management participation, such as security committee minutes (1.1)
- The information asset inventory is current (1.2.1)
- Risk assessment results, DoA, and the protection measure plan are linked (1.2)
- A substantive management system review was performed at least once a year (1.4)
[Protection measure requirements]
- Processor/third-party contracts have security clauses and there are inspection records (2.3)
- Access requests, approvals, and periodic reviews are recorded (2.5)
- Password and encryption policies are applied on actual systems (2.7)
- Access records are retained for the required period and reviewed regularly (2.9)
[Requirements by personal information processing stage]
- Consent forms match actual collection and use (3.1)
- Third-party provision and outsourcing are reflected in the privacy policy (3.3, 3.5)
- Destruction can be proven with a destruction log and certificates (3.4)
Frequently Asked Questions (FAQ)
Q. How long does ISMS-P preparation actually take? A. Building the management system and accumulating at least 2–3 months of operating evidence typically takes 3–6 months for preparation alone. Including the audit, remediation, and certification committee, 8–12 months total is realistic.
Q. If we only have ISMS, is personal information not certified? A. Correct. ISMS covers only the information security management system. To certify collection, use, provision, destruction, and other processing stages, you need ISMS-P, which adds the 21 personal information criteria. If you already hold ISMS, you can convert via an expansion audit.
Q. If we use the cloud, is CSAP enough? A. No. CSAP certifies the cloud service itself; ISMS-P certifies the organization’s information security and personal information protection management system. Purpose and scope are different. If you are a mandatory subject, you need ISMS-P (or ISMS) regardless of whether you use the cloud.
Sources · checked 2026-10-06
- ISMS-P portal, certification criteria — management system 16 (1.1–1.4), protection measures 64 (2.1–2.12), personal information processing stages 21 (3.1–3.5)
- PIPC, ISMS-P certification overview — number of criteria by area
- PIPC press release, measures to strengthen the effectiveness of ISMS/ISMS-P certification (2026-04-10) — mandatory ISMS-P targets, three-tier scheme, preliminary-audit core items and technical audits, stronger follow-up and revocation
Sources and checks vary by article. Only articles with a recorded check date, scope and sources below were checked, and only within that scope. For other articles, verify against the current docs for your version before applying anything, and email us about errors. Editorial policy · email us
This article has no recorded human check (date and scope) yet.
Comments
Be the first to comment.