South Korea will sharply expand mandatory information security disclosures starting next year to cover all listed companies, state-run institutions and financial firms.
The Ministry of Science and ICT (MSIT) said a revised enforcement decree of the Information Security Industry Act cleared a Cabinet meeting on the 20th. Under the disclosure system, companies must publish details of their information security investments and staffing, as well as related certifications, assessments, inspections and activities.
The revision follows up on a government-wide information security package announced in October last year. At the time, the government said it would close gaps in the disclosure system and encourage companies to view information security as an investment rather than a cost.
Under the revised decree, the disclosure requirement will extend to all companies listed on the main KOSPI board and the KOSDAQ market. Previously, only listed companies with annual revenue of 300 billion won ($209 million) or more were required to file the disclosures. That threshold has been removed.
The government also scrapped exemptions for state-run institutions, small enterprises, financial companies and electronic finance operators. Entities required to obtain Information Security Management System (ISMS) certification were newly added to the list of filers. Small enterprises as defined under the enforcement decree of the Framework Act on Small and Medium Enterprises, however, will not be subject to the requirement until Jan. 1, 2029, two years later, in consideration of their business conditions.
The standard for counting users was changed to the average daily number of users over the entire previous year, from the previous measure of average daily users during the three months before the end of the prior year.
"Information security disclosure is an important system that guarantees the public's right to know and encourages voluntary corporate investment in information security," said Bae Kyung-hoon, deputy prime minister and minister of science and ICT. "We expect this expansion of mandatory filers to further spur information security investment and establish a virtuous cycle that raises the level of information security across the country."