What is CSAP?
CSAP (Cloud Security Assurance Program), told as a story about the king's inspector checking a rented warehouse and stamping it.
The office wants to rent an outside warehouse, but isn't sure it's safe.The clerk isn't sure whether it's safe to trust the office's records to a rented warehouse (the cloud).
Every warehouse just claims to be safe.Everyone says they're safe, but with no common standard, there's no way to know who to believe.
CSAP is the king's inspector checking a rented warehouse against a fixed list and stamping it.The inspector checks against a fixed list and stamps only the warehouses that pass. → ongoing door-checks on the rented warehouse continue even after the stamp.
A warehouse's tier decides what kind of record it may hold.The more sensitive the record, the higher the tier it needs.
Getting the stamp doesn't end the checking.CSAP is a Korea-specific system that doesn't carry abroad, and the door-checking continues even after the stamp.
CSAP = the king's inspector checks a rented warehouse (the cloud) against a fixed list and gives it a stamp. Without a stamp, a government office must consult the National Intelligence Service first.
CSAP, Cloud Security Assurance Program. Run by the Ministry of Science and ICT, with KISA (Korea Internet & Security Agency) handling the certification work, it reviews and certifies a cloud service's physical, technical, and managerial security level. Korean public agencies generally use private cloud services that passed both CSAP and the National Intelligence Service's security review, and the certification is tiered by how sensitive the information is. The older IaaS, SaaS standard, and SaaS simplified tracks were reorganized into high, medium, and low tiers. The low tier is meant for systems with public data and no personal information, the medium tier for systems with non-public work records, and the high tier for systems handling major national interests such as security and diplomacy or internal administration (as reported when the tiers were introduced in 2023). In September 2026 the National Intelligence Service announced a plan to merge CSAP and its own security review into a single NIS review and to replace these tiers with N2SF's classified, sensitive, and open (C/S/O) grades. It is considering applying this from the second half of 2027 at the earliest.
When grown-ups say it
- CSAP
- The king's safety stamp on a rented warehouse. Korea's Cloud Security Assurance Program.
- KISA
- The king's inspector who checks it. The Korea Internet & Security Agency, which handles this certification's work.
- High/Mid/Low Tiers
- Grading warehouses by how safe they are. The more sensitive the data, the higher the tier the warehouse must hold.
- Condition for public agencies
- Without a stamp, an office must consult the NIS first. A precondition for any public-sector cloud migration.
- CSPM
- The door-checking that continues after the stamp. CSAP is a certification renewed at set intervals; CSPM is the continuous check in between. → door-checking the rented warehouse
- Cloud
- The rented warehouse. A warehouse kept outside the castle and rented for use.
- Physical security
- The safety of the warehouse building itself. One of the items on the inspector's checklist.
- Compliance
- The broader idea of an inspector confirming the rules were followed. CSAP is a compliance program specific to the cloud. → the inspector from the neighboring kingdom