ISMS·ISMS-P simplified certification scheme takes effect…'easing burden on SMEs'

2024.07.23. The Fair Economy — The Ministry of Science and ICT, the Personal Information Protection Commission, and the Korea Internet & Security Agency (KISA) announced on the 24th that they will implement the 'simplified certification' scheme, a special case for ISMS and ISMS-P certification, which simplifies certification standards and costs to ease the burden on small and medium-sized enterprises (SMEs) when they obtain 'Information Security Management System (ISMS)' or 'Information Security and Personal Information Protection Management System (ISMS-P)' certification.

The current ISMS and ISMS-P certification systems were designed so that mid-sized companies or larger can meet the standards, leaving SMEs struggling with numerous requirements and high costs to obtain and maintain certification. The Korea Federation of Small and Medium Business and other groups have therefore proposed a simplified system with lighter evaluation elements and lower costs for micro and small businesses.

In response, the government amended the Information and Communications Network Act to introduce a special provision allowing SMEs to obtain certification under relaxed standards and costs based on their size and characteristics. The law was promulgated in January, and subordinate regulations defining the scope, standards and fees of the special provision were revised to lay the institutional groundwork for the simplified ISMS and ISMS-P systems.

The simplified ISMS and ISMS-P certification is available to SMEs with revenue of less than 30 billion won in the information and communications services sector, as well as mid-sized companies with revenue of 30 billion won or more that do not hold major in-house information and communications equipment.

Not holding major in-house equipment means a company does not own its own servers, network devices or security solutions, but instead uses web hosting services such as rented shopping mall platforms or cloud services.

The Ministry of Science and ICT said 85 companies (about 16%) among all mandatory ISMS and ISMS-P targets are expected to qualify for the simplified certification. Details can be found on Kisa's website (https://isms-p.kisa.or.kr).

However, even if they meet the eligibility requirements, major information and communications service providers with a direct impact on daily life, operators of concentrated information and communications facilities, some tertiary hospitals and universities, financial companies and virtual asset businesses cannot receive the simplified ISMS or ISMS-P certification.

The certification standards retain core mandatory items that enable companies to carry out substantive information security activities, while unnecessary items for SMEs were removed or relaxed to reduce their burden. As a result, the number of standard items was cut by 36 to 40 compared with before.

Certification review fees are also expected to be reduced by about 40% to 50% from previous levels due to the simplified standards. Companies' overall costs for preparing certification, such as building security systems, forming information security teams and consulting, are also expected to decline.

Meanwhile, Kisa plans to hold an online briefing on the 24th to guide eligible companies on the procedures and methods of the newly introduced simplified ISMS and ISMS-P systems, helping them settle into the new regime.