TheArtOfService
Back to Frameworks

South Korea Cloud Security Assurance Program (CSAP)

Self-Assess
South Korea
v2016 (revised 2023)
12 domains
23 controls

The South Korea Cloud Security Assurance Program (CSAP), operated by the Korea Internet & Security Agency (KISA) under the Cloud Computing Act, is a mandatory certification for cloud service providers serving government agencies and public institutions. It evaluates cloud services against security requirements across 14 control areas. Three certification levels: standard, enhanced, and SaaS simplified. Annual renewal required.

Verified

South Korea Cloud Security Assurance Program (CSAP) is a compliance framework from South Korea with 12 domains and 23 controls that map to 31 other frameworks. The largest domains are Logging, Vulnerability and Incident Management (3 controls), Policy, Risk and Personnel (3 controls), Scope and Certification (3 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (12)

Audit

1 controls
Controls in the Audit domain of South Korea Cloud Security Assurance Program (CSAP) — 1 controls
CodeTitle
KRCSAP-4Audit, Recertification, KISA Cooperation

Certification

1 controls
Controls in the Certification domain of South Korea Cloud Security Assurance Program (CSAP) — 1 controls
CodeTitle
KRCSAP-1CSAP Certification Tiers (IaaS, SaaS, DaaS, AI)

Cloud Security

1 controls
Controls in the Cloud Security domain of South Korea Cloud Security Assurance Program (CSAP) — 1 controls
CodeTitle
KRCSAP-2Cloud Security Controls

Continuity and Change Management

2 controls

Continuity and Change Management

Controls in the Continuity and Change Management domain of South Korea Cloud Security Assurance Program (CSAP) — 2 controls
CodeTitle
CSAP-BCP-09Business continuity and disaster recovery
CSAP-CHG-10Change management

Cryptography and Access Control

2 controls

Cryptography and Access Control

Controls in the Cryptography and Access Control domain of South Korea Cloud Security Assurance Program (CSAP) — 2 controls
CodeTitle
CSAP-CRYP-04Cryptographic controls and key management
CSAP-IAM-05Identity and access management

Data Protection and Privacy

2 controls

Data Protection and Privacy

Controls in the Data Protection and Privacy domain of South Korea Cloud Security Assurance Program (CSAP) — 2 controls
CodeTitle
CSAP-DATA-14Data classification and protection
CSAP-PRIV-20Privacy and personal information protection

Data Sovereignty

1 controls
Controls in the Data Sovereignty domain of South Korea Cloud Security Assurance Program (CSAP) — 1 controls
CodeTitle
KRCSAP-3Data Sovereignty, Domestic Storage

Logging, Vulnerability and Incident Management

3 controls

Logging, Vulnerability and Incident Management

Controls in the Logging, Vulnerability and Incident Management domain of South Korea Cloud Security Assurance Program (CSAP) — 3 controls
CodeTitle
CSAP-INC-07Incident response and breach notification
CSAP-LOG-06Logging and security monitoring
CSAP-VUL-08Vulnerability and patch management

Physical and Network Security

2 controls

Physical and Network Security

Controls in the Physical and Network Security domain of South Korea Cloud Security Assurance Program (CSAP) — 2 controls
CodeTitle
CSAP-NET-03Network segmentation and boundary protection
CSAP-PHYS-02Physical and environmental security

Policy, Risk and Personnel

3 controls

Policy, Risk and Personnel

Controls in the Policy, Risk and Personnel domain of South Korea Cloud Security Assurance Program (CSAP) — 3 controls
CodeTitle
CSAP-HR-12Personnel security
CSAP-POL-19Information security policy framework
CSAP-RIA-18Risk assessment and management

Scope and Certification

3 controls

Scope and Certification

Controls in the Scope and Certification domain of South Korea Cloud Security Assurance Program (CSAP) — 3 controls
CodeTitle
CSAP-AUD-15Audit and certification maintenance
CSAP-CUST-17Customer responsibility and shared model documentation
CSAP-SCOPE-01Service scope and tier determination

Secure Development and Tenancy

2 controls

Secure Development and Tenancy

Controls in the Secure Development and Tenancy domain of South Korea Cloud Security Assurance Program (CSAP) — 2 controls
CodeTitle
CSAP-SAAS-16SaaS specific isolation and tenancy
CSAP-SDLC-11Secure software development lifecycle

Your Compliance Coverage

If you comply with South Korea Cloud Security Assurance Program (CSAP), you already cover:

HKMA SPM

4%

1 controls mapped

Compare →

ASIS SPC.1-2009 - Organizational Resilience Standard

4%

1 controls mapped

Compare →

ISO/IEC 27007:2020

4%

1 controls mapped

Compare →

+ 28 more: BS 65000:2014 - Guidance on Organizational Resilience (4%), ASD Strategies to Mitigate Cyber Security Incidents (4%)

See all 31 mapped frameworks ↓

Maps to 31 other frameworks

23 total controls
HKMA SPM
1 source controls mapped|1 target controls covered
4%
ASIS SPC.1-2009 - Organizational Resilience Standard
1 source controls mapped|3 target controls covered
4%
ISO/IEC 27007:2020
1 source controls mapped|1 target controls covered
4%
BS 65000:2014 - Guidance on Organizational Resilience
1 source controls mapped|1 target controls covered
4%
ASD Strategies to Mitigate Cyber Security Incidents
1 source controls mapped|1 target controls covered
4%
ISO/IEC 38500:2024 - Governance of IT
1 source controls mapped|1 target controls covered
4%
IEC 62351 - Power Systems Communication Security
1 source controls mapped|2 target controls covered
4%
ISO/IEC 27031:2011
1 source controls mapped|2 target controls covered
4%
FFIEC Cybersecurity Assessment Tool (CAT)
1 source controls mapped|1 target controls covered
4%
FTC GLBA Safeguards Rule (16 CFR Part 314)
1 source controls mapped|1 target controls covered
4%
GLBA
1 source controls mapped|1 target controls covered
4%
HKMA Cyber Resilience Assessment Framework (C-RAF)
1 source controls mapped|1 target controls covered
4%
NIST Privacy Framework
1 source controls mapped|2 target controls covered
4%
SASB Standards
1 source controls mapped|1 target controls covered
4%
Protective Security Policy Framework (PSPF) Release 2024
1 source controls mapped|1 target controls covered
4%
PSD2 SCA
1 source controls mapped|1 target controls covered
4%
OSFI B-13
1 source controls mapped|2 target controls covered
4%
Open Banking Security
1 source controls mapped|2 target controls covered
4%
OECD AI Principles
1 source controls mapped|1 target controls covered
4%
O-RAN WG11 Security Specification
1 source controls mapped|1 target controls covered
4%
NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security
1 source controls mapped|2 target controls covered
4%
Nevada Gaming Control Board Cybersecurity Requirements
1 source controls mapped|1 target controls covered
4%
NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC)
1 source controls mapped|1 target controls covered
4%
MTCS (Singapore)
1 source controls mapped|1 target controls covered
4%
Monetary Authority of Singapore Technology Risk Management Guidelines
1 source controls mapped|2 target controls covered
4%
Japan AI Guidelines
1 source controls mapped|1 target controls covered
4%
ITU-T X.805 - Security Architecture for End-to-End Communications
1 source controls mapped|1 target controls covered
4%
IRM Enterprise Risk Management Framework (Institute of Risk Management)
1 source controls mapped|1 target controls covered
4%
India CERT-In Cyber Security Directions 2022
1 source controls mapped|1 target controls covered
4%
IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2)
1 source controls mapped|1 target controls covered
4%
IEEE 7000
1 source controls mapped|1 target controls covered
4%
Compare South Korea Cloud Security Assurance Program (CSAP) with HKMA SPM

What is South Korea Cloud Security Assurance Program (CSAP) and who does it apply to?

South Korea Cloud Security Assurance Program (CSAP) is a compliance framework from South Korea with 12 domains and 23 controls. The South Korea Cloud Security Assurance Program (CSAP), operated by the Korea Internet & Security Agency (KISA) under the Cloud Computing Act, is a mandatory certification for cloud service providers serving government agencies and public institutions. It evaluates cloud services against security requirements across 14 control areas. Three certification levels: standard, enhanced, and SaaS simplified. Annual renewal required. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does South Korea Cloud Security Assurance Program (CSAP) actually require?

South Korea Cloud Security Assurance Program (CSAP) has 23 controls organised across 12 domains. The largest domains are Logging, Vulnerability and Incident Management (3 controls), Policy, Risk and Personnel (3 controls), Scope and Certification (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of South Korea Cloud Security Assurance Program (CSAP) do I already cover?

South Korea Cloud Security Assurance Program (CSAP) maps to 31 other compliance frameworks. The top mapping partners are HKMA SPM (4% coverage), ASIS SPC.1-2009 - Organizational Resilience Standard (4% coverage), ISO/IEC 27007:2020 (4% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement South Korea Cloud Security Assurance Program (CSAP)?

Start your South Korea Cloud Security Assurance Program (CSAP) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about South Korea Cloud Security Assurance Program (CSAP) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 23 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required