CSAP Tiered Certification
Korea’s Cloud Security Assurance Program restructured into 3 tiers by data sensitivity, and what it requires of public agencies adopting cloud services.
I. Overview
%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
A["Uniform\ncertification standard"] -- "differentiating by\ndata sensitivity" --> B["3-tier system\n(High / Medium / Low)"]
style A fill:#f9f9f9,stroke:#333,stroke-width:3px
style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px
Definition: The Cloud Security Assurance Program ( CSAP ) is a certification scheme that applies differentiated security criteria in 3 tiers, “High, Medium, and Low,” according to the sensitivity of the data handled by the cloud service a public agency intends to adopt.
Background of the restructuring:
( Market opening ) Permitting logical network separation for the “Low” tier lowers the barrier for global CSPs and innovative SaaS providers to enter the public sector market.
( Accelerating transition ) Expands the scope for using private cloud to accelerate the public sector’s cloud-native transition.
( Greater flexibility ) Moves away from a one-size-fits-all security standard and applies the security controls best suited to the nature of the data, improving management efficiency.
II. Mechanism & Components
The 3-Tier System by Data Sensitivity
flowchart LR
A["Classification\nby data sensitivity"] --> H["High Tier\nCore national\nadministrative agencies"]
A --> M["Medium Tier\nIncludes non-public /\npersonal information"]
A --> L["Low Tier\nMostly public data"]
H --> H1["Physical network separation\nonly public-dedicated CSPs allowed"]
M --> M1["Physical network separation\nonly public-dedicated CSPs allowed"]
L --> L1["Logical network separation allowed\nglobal CSPs can enter\nSaaS Direct certification applies"]
Key point: Tiers range from core national networks (High), through those including sensitive information (Medium), to mostly public data (Low).
Detailed Certification Requirements by Tier
| Tier | Applicable Scope (Data Sensitivity) | Key Security Requirements | Physical Separation Requirement |
|---|---|---|---|
| High | Core national administrative agencies handling diplomacy/security, investigation/trial, etc. | Highest security level, for services requiring high performance such as AI/big data | Physical network separation maintained (public-dedicated only) |
| Medium | Non-public consultation data, services including personal information (equivalent to the existing CSAP level) | Protection of sensitive information, vulnerability inspection, incident response system | Physical network separation maintained (public-dedicated only) |
| Low | Public services handling data without personal information, mainly public data | Commercial general-purpose services (SaaS/IaaS) allowed, demonstration-focused security | Logical network separation allowed (global CSPs can enter) |
III. Advanced Topics & Comparison
- Selecting a system tier: Public agencies must evaluate the importance of their own service and select a CSP of the appropriate tier according to the official guidelines.
- SaaS Direct certification: For the “Low” tier only, a simplified certification procedure lowers the barrier for innovative private-sector software to enter the public sector.
- Strengthening post-certification management: To address security concerns raised by the relaxed tiering, the program needs to shift to continuous monitoring and inspection based on actual data.
Last updated 18 Aug 2026, 00:00 UTC.