Certification scope
Define entities, services, sites, staff, systems and outsourced boundaries.
Security & cloud
Start with mandatory eligibility and certification scope
ISMS assesses an organization's information security management system. The assessment focuses on scoped services, people, facilities and operating evidence rather than testing one product.
Source record updated:
Discuss your certification →Scope and applicability
Korean information security management system certification
KISA identifies categories including ISPs and IDCs, and information service providers meeting criteria such as prior-year service revenue of KRW 10 billion or one million average daily users. Applicability is category-specific; obligated entities can select ISMS or ISMS-P.
Korean certification schemes and international standards are different. A translated guide does not extend a Korean certificate to other countries. Confirm the target market, product classification and current requirements with the relevant body.
Who this is for
- Online services checking revenue and user thresholds
- IDC and communications service providers
- SaaS teams responding to customer security requirements
Documents to prepare
Asset inventory and risk assessment
Connect threats and vulnerabilities to risk treatment plans.
Operating evidence
Prepare access reviews, training, log reviews, internal audits and management reviews.
Preparation process
Check eligibility and scope
Compare service revenue, users and exemptions with official criteria.
Build and operate controls
Implement policies and accumulate the required operating history.
Apply and address findings
Confirm scope through preliminary review, complete the assessment and resolve deficiencies.
Timing
Plan scoping, implementation, operations, assessment waiting time and corrections separately. Confirm the minimum two months of pre-application operation and the body's schedule.
Agency fees
Assessment and direct expenses
Calculated using the official fee worksheet
Fees depend on facilities, personnel, assessment type and scope. Confirm assessment fees and direct expenses separately.
Sources and references ↗Document automation and management cost KRW 300,000 per month. Expert services and certification body testing or assessment fees are separate. Specify supports preparation; the relevant authority or certification body makes the final decision.
Pricing and certification costs →Optional expert consulting
Expert review and consulting are optional, separately scoped services. Choose support for ISMS Certification based on your team's readiness and the evidence or assessment preparation you need.
- Confirm institutional testing, assessment and registration fees separately in the contract.
- Development fixes, clinical studies where applicable, security equipment and infrastructure operations may require separate budgets.
- Confirm internal staffing, travel, translation, VAT, surveillance and renewal costs in the quotation.
Questions and answers
Does KRW 10 billion in revenue always trigger the requirement?
Total revenue and information service revenue are different. Check the applicable service structure and statutory category.
Is outside consulting mandatory?
No. Internal teams may prepare, while institutional assessment fees remain separate.
Are further assessments required?
The certificate is valid for three years, with surveillance and renewal to plan.