The National Intelligence Service (NIS) plans to centralize security verification for public-sector private cloud services from the second half of next year, replacing the current dual process involving the Ministry of Science and ICT’s Cloud Security Assurance Program (CSAP). Existing CSAP certifications will remain valid through their current terms. The revised framework would classify services as Classified (C), Sensitive (S) or Open (O) under the National Network Security Framework, replacing CSAP’s high, medium and low tiers. For the S tier, data planes would still have to be located domestically, while control planes (monitoring and operational systems) and operational personnel could be based overseas. The NIS would also allow international encryption standards such as AES and equipment certified under Common Criteria (CC), alongside KCMVP cryptographic modules. Domestic cloud providers say the changes risk disadvantaging companies that invested in local infrastructure and compliance, while foreign providers argue that domestic data-plane requirements still make public-sector entry costly. Professor Kim Seung-joo of Korea University’s Graduate School of Information Security also questioned the reform’s transparency, GPU efficiency and the continued need for providers serving both public and private markets to obtain separate NIS and Ministry of Science and ICT certifications.