Cloudflare Achieves South Korea's ISMS-P Certification, Localizes User Consent

ISMS-P Certification Achieved

Cloudflare, a company headquartered in the United States, has obtained South Korea's Information Security Management System (ISMS) certification under the ISMS-P framework. This certification followed a ten-day audit conducted by auditors appointed by the Korea Internet & Security Agency (KISA), who reviewed 80 controls.

Localized Consent for Korean Users

The certification process required Cloudflare to localize its security and privacy program to align with Korean law, language, and regulatory expectations. A visible outcome of this effort is the modified Cloudflare account sign-up page for users in South Korea.

Korean users now encounter a different sign-up experience, triggered by country selection or IP geolocation. Instead of a single agreement statement, the consent is broken into four separately labeled items: "Agree to all," "[Required] Terms of Service," "[Required] Collection and use of personal information," and "[Required] Transfer of a limited amount of personal information overseas." An optional item for marketing consent is also presented.

Mandatory Agreement for Account Creation

The three required consent items act as hard gates; the sign-up button remains disabled until all three are checked. This ensures that users provide affirmative action for each mandatory agreement before an account can be created. The optional marketing consent does not affect account creation.