Service and asset specification
Identify architecture, infrastructure location, leased assets and responsibilities.
Security & cloud
Align public sector cloud scope with transition plans
CSAP assesses a cloud service against security criteria. Establish IaaS, SaaS or DaaS boundaries, underlying infrastructure and operating responsibilities before comparing scope and cost.
Source record updated:
Discuss your certification →Scope and applicability
Korean cloud service security assessment and certification
CSAP concerns supply to Korean national and public institutions, not all private SaaS. The government announced a unified NIS-centered verification framework planned for the second half of 2027, with recognition of existing CSAP validity. This does not mean CSAP was abolished in 2026.
Korean certification schemes and international standards are different. A translated guide does not extend a Korean certificate to other countries. Confirm the target market, product classification and current requirements with the relevant body.
Who this is for
- SaaS providers entering Korean public procurement
- Public sector IaaS and DaaS providers
- Certified services planning for the announced transition
Documents to prepare
Security policies and operations
Document access, logs, backup, incident response and supply-chain controls.
Technical and operating evidence
Retain vulnerability remediation, penetration tests, access reviews and change records.
Preparation process
Confirm procurement requirements
Check workload importance, adoption conditions and the current certification route.
Agree scope and implement controls
Separate infrastructure and service duties and prepare operational evidence.
Assess and maintain
Agree fees, resolve findings and complete surveillance activities.
Timing
Include infrastructure readiness, operational evidence, assessment queues and correction time. Confirm the planned 2027 transition dates and transitional rules with the application body.
Agency fees
Institutional assessment fees
Current official calculation and assessor quotation
Fees depend on service type, size and initial or follow-up assessment. Funding conditions are separate.
Sources and references ↗Document automation and management cost KRW 300,000 per month. Expert services and certification body testing or assessment fees are separate. Specify supports preparation; the relevant authority or certification body makes the final decision.
Pricing and certification costs →Optional expert consulting
Expert review and consulting are optional, separately scoped services. Choose support for CSAP Cloud Security Certification based on your team's readiness and the evidence or assessment preparation you need.
- Confirm institutional testing, assessment and registration fees separately in the contract.
- Development fixes, clinical studies where applicable, security equipment and infrastructure operations may require separate budgets.
- Confirm internal staffing, travel, translation, VAT, surveillance and renewal costs in the quotation.
Questions and answers
Was CSAP abolished in 2026?
The announcement plans full implementation of a unified framework in the second half of 2027 after a transition, while recognizing existing certificate validity.
Does CSAP permit every public sector workload?
Check workload importance, national cloud security criteria, eligible service lists and purchaser requirements.
Does consulting include assessment fees?
Contract scope varies. Itemize assessor fees, technical reviews, development remediation and infrastructure operations.