ISMS-P

Enterprise buyers check a vendor's security before signing. That check used to happen entirely through a security questionnaire — a list of anywhere from dozens to hundreds of questions the buyer sends over and the vendor answers one by one.

The trouble was that every buyer's list was different. One sent 80 items, another sent 300, and even questions asking the same thing were worded differently enough that old answers couldn't be reused. On the selling side, one engineer disappeared for two weeks per deal. On the buying side, there was no way to tell whether the answers that came back were true. A company grading its own homework tends to grade generously.

So a different arrangement took hold: run the check once, thoroughly, and let many buyers share the result. A qualified auditor works through a fixed control list, issues a certificate, and buyers accept that certificate in place of their own investigation. ISMS-P is South Korea's version of that arrangement. The P stands for personal information. An earlier certification, ISMS, covered the information security management system alone; ISMS-P adds the handling of personal data — how it is collected, used, and destroyed — to the same audit.

It ends the work of answering the same questions over and over. With a certificate in hand, much of a buyer's questionnaire is satisfied by a copy of it. Two weeks of vendor effort becomes a day, and the buyer gets a third party's finding instead of the vendor's own account of itself.

It also fills a legal requirement. Korean law obliges telecommunications and online service operators above certain revenue and user thresholds to hold ISMS certification. Past those thresholds it stops being a choice and becomes a question of whether the company qualifies. The broader ISMS-P scope, which takes in personal data handling, is not itself mandatory — a company opts into the wider audit.

The third effect points inward. What an audit demands is not rules but evidence, the record showing the rules were followed. "We disable accounts when people leave" does not pass. What passes is a system log showing each of the twelve people who left last year, the date their access was revoked, and who revoked it. Companies that stall in preparation usually stall not because rules are missing but because nothing recorded that anyone followed them.

Preparation generally runs in this order.

1. Set the scope. Draw a line around which services and systems get audited. Draw it narrowly and preparation finishes sooner, but the feature a customer is asking about may end up outside the certificate.
2. Write down, for each item on the control list, how the company handles it. There are roughly a hundred controls — individual measures each aimed at reducing one specific risk.
3. Close the gaps. Most of this work is moving tasks that leave no trace into systems that do.
4. Run an internal audit first. A finding raised externally stays in the report even after it's fixed.
5. Go through the on-site audit, remediate what the auditors flag, and receive the certificate.

Receiving it is not the end. The certificate is valid for three years, with a surveillance audit each year and a full renewal audit at the end of the cycle.

This is not the only way to prove the same thing, and the choice is driven less by technology than by where the customers currently blocking a deal happen to be.

1. Answering questionnaires directly — cheaper while there are fewer than ten enterprise customers. Two weeks per deal still costs less than what certification takes in money and months. Past twenty customers, that reverses.
2. ISO/IEC 27001 — an international standard, so the name alone explains itself to a customer in any country. Companies with revenue abroad look here first.
3. SOC 2 — the format American enterprise buyers ask for. It comes back as a report written by an accounting firm rather than as a pass or a fail.

Picking one doesn't make the others go away. A company selling into several markets ends up holding several certificates. The second one, though, takes far less time than the first, because evidence for overlapping items — access reviews, revoking departed employees' accounts — gets reused as is. Build a mapping once, showing which control on one list corresponds to which on another, and after that the same material simply gets reformatted.

"Without ISMS-P we can't even enter the bid."

The certification is a contract condition, not something a sales effort can get around.

"Should this service go inside next year's audit scope?"

Deciding whether a newly built product sits inside the certificate or outside it.

"Does that leave evidence?"

Checking, while a feature is being built, whether it automatically accumulates the records an auditor will ask for.

At Pagedeck it's Sofia who raises it first, because public sector and financial customers keep stopping at the same item during review. Grace had been putting it off on cost and timeline, but once five deals were blocked she decided to start.

Once preparation actually began, much of the work landed on the product team. Theo took on logging access to the production database, and Mia gathered certificates from the nineteen outside tools Pagedeck uses for its vendor assessment. Because customer data doesn't stop at Pagedeck's servers, the audit covers those vendors too.

The most common misreading is that certification makes a company secure. A certificate looks like a guarantee, so the reading is easy to arrive at. What the scheme verifies, though, is the rules a company set for itself and the record that those rules ran — not whether an attack can be stopped. Certified companies get breached. Treating the certificate as a guarantee leads to security spending stopping the day it arrives, and from then on the certificate and the actual state of things drift apart.

The second is treating it as a qualification you earn once. Preparation is long and the moment of passing is sharp, which makes it feel like an exam. In practice it verifies, every year, that a security governance system — the organization's standing security rules and procedures — is still running. Reassign the owner to something else after passing and the next surveillance audit finds a year of missing evidence.