ISMS-P · Information Security Management System Certification
Personal Information & Information Security Management System
What is ISMS-P?
- Combined certification for information security and privacy management systems (KISA)
- ISMS certification is a legal requirement for businesses that meet certain criteria
- Regular 'operating evidence,' not documents, decides whether you pass
Preparing for ISMS-P certification means shifting the focus of security work from 'respond when an incident happens' to 'keep records that prove you did the work all along.' Auditors do not ask what equipment you bought. They check who reviewed access rights over the past year, when they did it, and how many accounts were revoked as a result. So preparation is not about buying tools but about making periodic activities a standing process. You also feel the difference in sales. On the supplier security checklists that large corporations’ procurement teams send out, a single certificate often replaces dozens of questions at once, noticeably shortening contract review.
ISMS and ISMS-P are not higher and lower tiers; they differ in audit scope. If the scope includes personal information processing flows, it is ISMS-P; if not, it is ISMS. The applicant also defines the in-scope services, systems, and physical locations listed on the certificate. Certification is valid for 3 years, and it stays in force only if you pass an annual surveillance audit and a renewal audit before expiry. Under Korea’s Network Act, certification is mandatory for telecom carriers, internet data center (IDC) operators, and information and communications service providers above certain revenue or user-count thresholds. Non-compliance can result in administrative fines. Because the revenue and user-count thresholds change when the notice is revised, re-check every year whether your company is covered.
A common practical question is how this relates to ISO 27001. The two certifications have overlapping requirements, so you can reuse documents, but neither recognizes the other, and an ISO certificate cannot substitute for Korean legal obligations. The difference lies in the nature of the audit. ISO checks whether an organization follows standards it set for itself, while ISMS-P checks items one by one against the certification criteria published by KISA. Because global clients ask for ISO or SOC 2 and Korean public-sector and large-enterprise clients ask for ISMS-P, quite a few companies run both tracks in parallel.
The most common failure starts with scoping too narrowly. To reduce the audit burden, a company includes only one service and gets the certificate, but the module its clients actually use is out of scope. The clients say, "That service isn’t covered by the certification," and the company ends up preparing for a re-audit, again and again. This is why you need to get the scope items right before worrying about whether you hold a certificate. Another misconception is that the work is done once a consulting firm produces a set of policy documents. Documents take a month, but at least 2 to 3 months of operating records cannot be created retroactively, and certification does not exempt you from legal liability for a data breach.
Seungtae ParkA hands-on AX instructor who teaches AI business development and marketing automation by building them in practice
Seolyeong ParkGenerative AI and AX training expert with 17 years of hands-on experience and 200+ lectures, helping non-specialists put AI to work right awayInformation security (ISMS) and personal information protection (PIMS) management systems used to run separately. In 2018 they were merged into a single scheme, ISMS-P. The Korea Internet & Security Agency (KISA) runs the certification program under the policies of the Ministry of Science and ICT and the Personal Information Protection Commission.
Consider a hypothetical case: Company A, an HR SaaS provider with 140 employees and KRW 32 billion (≈ US$23,941,300) in annual revenue. Three major clients required an ISMS-P certificate as a condition of contract renewal, and pending deals piled up. With two dedicated security staff, the company started an 11-month preparation.
- The head of information security and the head of development clashed in the scoping meeting. When the developer said, "Clients only use the payroll module, and adding HR and recruiting will add 6 more months," the team cut the scope to 2 in-scope services and 84 servers.
- The self-assessment found 41 certification criteria items lacking, and half of those were 'we did the activity, but there is no record.' Replacing the development director, who was doubling as CPO, with the head of management support took 3 weeks on its own.
- Over seven months, the team ran a quarterly access review, a monthly log check, and a semiannual backup-restore test for real. The first review revealed 37 active accounts belonging to former employees and partner companies, and they were revoked the same day.
- While drawing the personal information flow map, the team found that 2 SMS delivery agencies used by marketing had been running for 3 years without a data processing contract. The head of legal said, "This is a fine issue before it is even an audit issue," and had the contracts redone first.
- The company received 9 findings in the main audit, closed them all within 40 days, and earned certification. Time spent responding to client security reviews dropped from an average of 3 weeks to 4 days, and the company secured 3 stalled contract renewals and 1 new public-sector deal.