CSAP · Cloud Security Certification
Cloud Security Assurance Program
What is CSAP?
- The must-pass gate for supplying public cloud services
- Tiered system (high/medium/low) in effect since 2024
- You have to show a working system, not just documents
Once CSAP applies, the order of public-sector sales flips. In the private sector you win on demos and price, but public tenders often state in the eligibility section that bidders must hold the certification, so you’re screened out before anyone reads your proposal. That makes certification more than a homework item for the security team: it affects the product roadmap and infrastructure contracts too. Which provider’s domestic region to host on, whether to run a separate public-sector environment alongside the private one, and who pays for the added capacity all have to be decided before you submit the application.
Certification is divided by service type into IaaS, PaaS, SaaS, and DaaS, and SaaS splits further into Standard and Simplified. Simplified is a track that applies relaxed requirements to services handling less sensitive information, so SaaS products such as collaboration tools or scheduling and attendance apps often start there. On top of that sit High, Medium, and Low tiers by system importance. The High tier adds network separation and physical requirements, which makes it effectively the same as building separate infrastructure from scratch. Validity periods, post-assessment cycles, and the assessment items for each tier change with every revision of the official notice, so it’s safer to cross-check against the latest version just before you apply.
People often assume that having ISMS-P makes CSAP quick to get, but the two certifications cover different things. ISMS-P certifies an organization's management system, while CSAP is a procurement qualification attached to one specific cloud service. Management-system documents and internal audit records shorten preparation, but access control, encryption, log retention and incident response must be proven with live system screens and real logs, so polishing documents alone won't get you through.
The biggest mismatch in practice is the scope of certification. Many companies assume they’re done because they deploy on a certified IaaS, but infrastructure certification and the SaaS certification for what runs on top are separate, so a SaaS must be certified in its own name. Because scope is defined per service, adding a new module to a certified product or changing its architecture takes that part outside the certification. If a buyer’s on-site review uncovers this, it can mean lost points or contract termination. Even after certification, if you don’t manage change history against the post-assessment criteria, the problems all surface at renewal.
Jaehyuk ParkHands-on instructor teaching B2B technical sales and AI-driven sales strategy
Seungtae ParkAX practitioner who teaches AI business development and marketing automation by building it liveThe security certification framework for public-sector cloud adoption was built on the Act on the Development of Cloud Computing and Protection of Its Users, enacted in 2015. Since 2024, a tiered system (high/medium/low) based on system criticality has been in effect.
Company A, a collaboration SaaS with 62 employees and KRW 9 billion (≈ US$6,733,500) in annual revenue, drew 95% of its sales from private-sector customers. It reviewed three local-government notices but couldn’t even submit a proposal because CSAP certification was written into the eligibility requirements. The CEO vowed not to miss next year’s public budget season and launched a 10-month certification project. (Hypothetical example)
- The head of public-sector sales reviewed the eligibility requirements in 41 notices from the past two years. 38 were screened out at the SaaS Simplified tier and only 2 required the High tier, so the team made Simplified its first target.
- When the CTO and the head of security checked the assessment items against the actual servers, they found that logs were retained for only 3 months and 7 operator accounts were shared. The head of security was firm: fix the servers, not the documents.
- They separated the public-sector tenant from the private one, hosted it separately in a domestic region, and spent 4 months redesigning per-account permissions and encryption key management. Infrastructure costs rose by KRW 4.8 million (≈ US$3,590) a month, which required separate CEO approval.
- Two weeks before the on-site assessment, a mock review flagged that there were no incident response drill records. The head of security ran a real drill over a weekend, saved action logs for each scenario and attached them as evidence.
- Seven months after applying, they earned Simplified-tier certification, took part in 9 public tenders that year, and won 2. With KRW 480 million (≈ US$359,100) in public-sector revenue, public sales made up 5% of total revenue for the first time.