What is ISMS/ISMS-P?
ISMS/ISMS-P, told as a story about a government inspector who checks the whole castle and hangs a certification plaque.
The lord just says our castle is safe.No proof — just the lord's own word.
The neighboring castle can't just take the lord's word.Without proof, neighbors hesitate to deal with you.
ISMS-P is the plaque a government inspector hangs after checking the whole castle.The inspector checks not just one door, but everything from the management system to the guest-info storeroom.
The checklist has three areas: management system, protection measures, personal-data lifecycle.ISMS covers areas 1–2 only; ISMS-P adds area 3 — needed by a castle certifying its guest-info storeroom too.
The plaque doesn't stop thieves.The plaque means the standard was met — not that nothing can go wrong. What actually protects the castle is the rule scroll and everyday upkeep.
ISMS/ISMS-P = the certification plaque a government inspector hangs after checking a castle's whole management system and protection measures. ISMS-P also checks the entire personal-data lifecycle.
ISMS (Information Security Management System) and ISMS-P (adding Personal Information protection) are statutory certifications in Korea, audited by bodies such as KISA and the Financial Security Institute. Major telecom and data-center operators, and businesses over revenue or user thresholds, must obtain ISMS under the Network Act; a certificate lasts three years, with an annual follow-up review during that time. ISMS covers the overall security management system; ISMS-P additionally reviews requirements across the full personal-data lifecycle, from collection to destruction. An amendment to the Personal Information Protection Act, promulgated on March 10, 2026, requires ISMS-P of personal-data handlers that meet revenue and processing-scale thresholds, and that duty takes effect on July 1, 2027. A presidential decree sets the thresholds: the ones in the June 2026 draft were left out of the decree that took effect on September 11, so as of November 2026 they are still undecided.
When grown-ups say it
- ISMS
- Security management system certification. Reviews the management system and the protection measures.
- ISMS-P
- ISMS plus the personal-data lifecycle. Also reviews collecting, using, and destroying guest info, start to finish.
- Certification body (KISA 등)
- The office that sends the inspector. Bodies such as KISA conduct the review.
- ISMS management process
- Policy, organization, risk assessment. Setting the whole castle's rules and who owns what. → the castle rule scroll
- Protection requirements
- Each lockdown item. Specific items like access control and encryption.
- Follow-up review
- Re-checked every year. Initial certification isn't the end — it's reviewed annually.
- Mandatory scope
- ISMS is mandatory past a certain size. Major telecom and data-center operators, and businesses over revenue or user thresholds, must obtain ISMS.
- Compliance
- The inspector checks the evidence. ISMS-P also has to prove with evidence that the standard was met. → the inspector from next door