As an audit designed to increase the credibility of services and service organizations, it is internationally regarded as a very strict and reliable certificate. The SOC 1 report, following the SSAE 18 certificate standards established by the AICPA (The American Institute of Certified Public Accountants), details the results of whether the user organization's ICFR-related (Internal Control over Financial Reporting) services are appropriately designed and effectively operated to be fit for control. The SOC 2 and SOC 3 reports contain results of whether organization and service-related procedures of businesses that provide security, availability, processing integrity, confidentiality, and personal information privacy-related services are well-managed and reliable. Not only do organizations need to have appropriate internal control protocols regarding safe provision of services and operations, but the protocols must be verified to have been implemented or are in no violation to be issued an certificate. SOC certificate means a business is implemented and operating at a global-level of internal control, and the certification details are issued in the form of an audit report.
The Cloud Security Alliance (CSA) issues the Security, Trust, and Assurance Registry (STAR) certification through the Cloud Control Matrix (CCM), which is designed to provide fundamental security principles to guide cloud service providers. CCM v.4 defines 197 control items organized into 17 domains. In addition to evaluating whether control requirements have been met, it also determines the maturity of an organization and its processes and produces a scorecard. Certification is only achieved after an organization passes a rigorous evaluation, which provides an objective, third-party assurance that the service provider’s cloud security controls are effective.
The Payment Card Industry Data Security (PCIDSS) Certification is an international data security standard developed to foster and promote data security for credit card owners and to promote widespread adoption of consistent data security processes. Major credit card companies like VISA, MasterCard, Amex, JCB, and Diners Club are certified by the Payment Card Industry Security Standard Council (PCISSC), which was established to audit and certify service providers.
The ISMS-P certification proves the adequacy of a series of measures and actions to protect information and personal information in accordance with the certification criteria, which can be provided by the Korea Internet Security Agency or other certification institutes. It can serve as the standard to decide whether a company continues its efforts to secure internal information, whether an adequate level of information security is maintained, and whether the company’s information security management system conforms to the standards set forth by laws and regulations.
MTCS (Multi-Tier Cloud Security) is a standardized cloud computing multi-tier security system providing certification services developed by IDA (Infocomm Development Authority of Singapore) and ITSC (Information Technology Standards Committee).Based on the international standard such as ISO/IEC 27001, the MTCS (SS 584:2015) for Singapore is the world's first multi-tier cloud security standard guaranteeing strict observance of the following contents under control categories.
| Category | Control Category |
|---|---|
| Cloud Governance | Information security management, Human resources, Risk management, Third party, Legal and compliance, Incident management, Data governance |
| Cloud infrastructure security | Audit logging and monitoring, Secure configuration, Encryption, Security testing and monitoring, System acquisitions and development |
| Cloud operations management | Physical and environmental, Operations, Change management, Business continuity planning (BCP) and disaster recovery (DR) |
| Cloud services administration | Cloud services administration |
| Cloud user access | Cloud user access |
| Tenancy and customer isolation | Tenancy and customer isolation |
MTCS comprises three security levels; from level 1, which provides the basic security, to level 3, which has the capability and maturity to make up for or solve security threats in influential information systems used in the control target organizations with specific matters, such as confidential business data, financial records, medical records, etc.
APEC CBPR certification is global personal information protection certification developed to support free and safe transfer of personal information and facilitation of electronic commerce among member countries. 9 countries, including Korea, United States, Japan, and Singapore, are included in the certification, and the certification validates the competency in transferring personal information overseas and processing it.
The Electronic Financial Supervision Regulations stipulate cloud service providers as subjects of evaluation as defined in the Cloud Computing Act. Financial companies evaluate them by dividing them into ‘basic protection measures’, which are general security standards that cloud service providers must comply with, and ‘additional protection measures for the financial sector’, which are specialized standards for the financial sector. NAVER Cloud Co., Ltd. has been verified as having a secure cloud service environment through CSAP certification, and is striving to assist in the ‘basic protection measures’ evaluation by obtaining and maintaining CSAP certification. In addition, we are actively supporting and cooperating with the evaluation of ‘additional protection measures for the financial sector’ by identifying matters necessary for financial customers to comply with laws and regulations.