ISMS-P Certification Prep: The 7 Most Common Audit Findings and a Checklist

ISMS-P Certification Prep Checklist 2026 — Start with the Findings That Come Up Most

"We got the certificate, but the same findings keep coming up at every surveillance audit."

If you've been through ISMS-P even once, you'll nod at that. The problem isn't the findings themselves—it's that the cost of fixing them (re-audits, consulting, overtime) often exceeds the original consulting fee. That's even more true for SMEs and startups where a single security person, or an infra/dev lead wearing two hats, is carrying the whole load.

This post is a practical checklist. It starts with whether your company is a mandatory subject, then walks through the items that most often produce nonconformities (findings) in real audits, in symptom → checkpoint → how to prepare order. The tables are built so you can self-assess just by reading them—copy and use them if you're already in prep.

⚠️ Revenue, timeline, and fee figures in this article are reference values to aid understanding. Mandatory-subject criteria and fees change when notices are revised, so always check the latest KISA announcements and notices.

1. Is Our Company a Mandatory Subject? ISMS vs. ISMS-P

Let's start with the terms.

• ISMS (Information Security Management System): certifies the information security domain only
• ISMS-P (Information Security and Personal Information Protection Management System): information security plus protection at each stage of personal information processing

In other words, if your service actually handles personal information—sign-up, payments, marketing consent, and so on—ISMS-P is the right fit. Conversely, if personal information is a small share of what you do (for example, B2B infrastructure services), ISMS alone may be enough.

2026 ISMS Mandatory-Subject Decision Table

The figures above are examples of representative criteria. Many companies also obtain certification voluntarily (even when not mandatory) to build trust or score points in bids. The trend of obtaining ISMS-P voluntarily even when it is not required has been especially clear among AI and SaaS startups in 2026.

2. Process, Timeline, and Cost at a Glance

From prep to certificate issuance typically takes 4–6 months. Larger scope or a first-time certification takes longer.

[Stage 1] Prep & gap analysis              (4–8 weeks)  Current-state assessment, policy setup, asset identification
   ↓
[Stage 2] Application & contract           (1–2 weeks)  Apply to the certification body, schedule audit dates
   ↓
[Stage 3] Pre-check (optional)             (1–2 weeks)  Mock audit to clear findings in advance
   ↓
[Stage 4] Main audit (desk + on-site)      (1–2 weeks)  Document & operational evidence review, interviews
   ↓
[Stage 5] Finding remediation              (2–6 weeks)  Address findings + submit evidence
   ↓
[Stage 6] Certification committee & issue  (2–4 weeks)  Deliberation/decision, then certificate issued

Cost Structure (scope and structure, not exact numbers)

💡 A note from the field: The line that most often goes missing from cost estimates is "internal effort." Consulting fees show up on the quote; the cost of your owner spending half of three months on certification does not. Securing the owner's available time when you set the schedule matters more than picking a consulting firm.

3. Checklist of Items That Frequently Produce Audit Findings (the core)

This is the main event. These are the items that repeatedly come back as nonconformities in real audits.

If You Use Cloud (AWS, etc.) — Watch the Shared Responsibility Model

As more SaaS and cloud-based startups have appeared in 2026, questions about shared-responsibility findings have spiked. The key point: "our cloud provider is certified, so we're done" is not true.

• Cloud provider responsibility: physical security, hypervisor, underlying infrastructure
• Customer responsibility: OS and above, access permissions (IAM), security groups, encryption settings, log collection

Auditors look at configuration and operational evidence in the customer-responsibility zone. Document and evidence least-privilege IAM, S3 bucket public-access blocks, CloudTrail log retention, and similar controls.

4. The Real Game Is Maintenance — Preparing for Surveillance and Recertification Audits

An ISMS-P certificate is valid for 3 years. The structure in between looks like this:

• Year 1: issuance
• Years 2 and 3: annual surveillance audit (confirms you are maintaining the system)
• After 3 years: recertification audit (essentially a full re-audit)

The most common failure pattern is "cramming operational evidence together right before the audit." Six months of inspection records all created on the same day—auditors spot that immediately. The right answer is to accumulate evidence in the ordinary course of work, which is why you need an annual routine calendar.

Annual Operational-Evidence Calendar Template

Just putting this table on the calendar cuts the surveillance-audit burden roughly in half. The core idea: evidence is not something you manufacture—it's something you let accumulate.

Frequently Asked Questions (FAQ)

Q1. Should we get ISMS or ISMS-P? A. If you actually process personal information—members, payments, marketing, and so on—ISMS-P is the right fit. Infrastructure-style services with a low share of personal information may be fine with ISMS alone. Whether you are a mandatory subject is a separate call based on revenue and user counts.

Q2. Can we prepare in-house without consulting? A. Yes. For a first time, though, getting outside help at least for gap analysis and a mock audit usually costs less than a re-audit later. From the second recertification onward, many companies run it with internal capability.

Q3. What's the minimum prep time? A. Even if documentation and operations are reasonably in place, application to issuance is typically 4–6 months. If you're starting from a blank page, budget an extra 2–3 months just to close gaps.

Q4. Can the certificate be revoked at a surveillance audit? A. Yes—if you fail to remediate material findings by the deadline, or the management system is effectively not operating, the certificate can be revoked or suspended. That's why day-to-day operational evidence matters.

Q5. If we use cloud (AWS, etc.), how far does our responsibility go? A. Under the shared responsibility model, underlying infrastructure is the cloud provider's; OS and above (IAM, encryption, logs, security configuration) is yours. Auditors check configuration and operational evidence in the customer-responsibility zone.

Q6. The numeric thresholds keep changing—where do we check? A. Mandatory-subject criteria, audit fees, access-record retention requirements, and similar items change when notices are revised. Use KISA (Korea Internet & Security Agency) ISMS-P scheme announcements and the latest notices as the source of truth.