Information security disclosure expansion the government promised for 'first half of next year' pushed to 2027; only 40 of 773 firms verified

SEOUL

Mandatory information security disclosure for all listed companies, which the government said last October it "plans to implement from the first half of next year" after a string of hacking incidents hit telecom carriers, financial firms and even government work networks, will take effect only on January 1, 2027. The Ministry of Science and ICT said an amendment to the Enforcement Decree of the "Act on the Promotion of the Information Security Industry" (Information Security Industry Act) to that effect passed the Cabinet meeting on the 20th. The amended decree removes the "revenue of 300 billion won or more" requirement for listed companies, imposing the disclosure obligation on all KOSPI- and KOSDAQ-listed corporations, and also deletes the exceptions for public institutions, financial companies and electronic financial business operators. Small enterprises among listed companies, however, will be covered from January 1, 2029. The scope of disclosure is expanding, but of the 773 companies that disclosed last year, the government post-verified 40, and the maximum administrative fine that can be imposed on companies that refuse verification or fail to file corrected disclosures is 10 million won.

Disclosure expansion the government said would come in 'the first half of next year' takes effect only in January 2027

Expanding disclosure was a key task of the "Pan-Government Comprehensive Information Protection Plan" announced jointly by related ministries on October 22 last year. Korea Policy Briefing material at the time said that "while expanding companies subject to mandatory information security disclosure to all listed companies," the government would "introduce a system that grades and discloses levels of security capability" based on the disclosure results. The same material described the comprehensive plan as having been "presented with a focus on short-term tasks that can be implemented immediately." It said a "National Cybersecurity Strategy" containing medium- to long-term tasks would be drawn up separately within the year, and in the briefing's question-and-answer session an answer came that it would be drawn up and announced "within December."

The timing of implementation came up directly in the briefing's question-and-answer session. When a reporter asked, "I'd like to ask once more just about the timing: is information security disclosure being made mandatory for all listed companies going to proceed right from next year?" the government side answered, "We have plans to implement mandatory information security disclosure from the first half of next year." The transcript does not identify the speaker of this answer. Standing together at the briefing were Bae Kyung-hoon, deputy prime minister and minister of science and ICT; Ryu Je-myung, second vice minister of science and ICT; Shin Jin-chang, secretary general of the Financial Services Commission; Lee Jeong-ryeol, secretary general of the Personal Information Protection Commission; Kim Chang-seop, third deputy director of the National Intelligence Service; and Lee Yong-seok, head of the Digital Government Innovation Office at the Ministry of the Interior and Safety.

Actual implementation came later than that. When the ministry gave advance notice of the decree amendment on January 9 this year, it said it "plans to proceed so that it can apply from those subject to information security disclosure in 2027." At that point, the application date had already been set for 2027. In a renewed advance legislative notice on May 11 (Ministry of Science and ICT Notice No. 2026-569), the addenda were changed. A new provision deferring the effective date by two years for small enterprises under the Framework Act on Small and Medium Enterprises, in consideration of their staffing and management conditions, was added. At the time of the January advance notice, Korea Policy Briefing material said the exception provision for small enterprises would be deleted. The period for submitting opinions on the renewed notice ran until June 22, and a regulatory impact analysis and statement of reasons for enactment and amendment by article were attached along with the draft. In the end, the disclosure expansion presented last October as a "short-term task" begins in 2027, and listed small enterprises will start disclosing only two years after that.

The announcement of the comprehensive plan itself was late. In the question-and-answer session, a government respondent began, "As for the reason for the delay from the end of September, actually, we have continued, centering on five ministries," and then said, "there was some delay in timing."

Science ministry cites closing blind spots and guaranteeing public's right to know

The Ministry of Science and ICT explained that the amendment would close blind spots in the disclosure system and guarantee the public's right to know, while encouraging companies to view information security as an investment rather than a cost. Deputy Prime Minister Bae Kyung-hoon said on the 20th, "Information security disclosure is an important system that guarantees the public's right to know and encourages companies' voluntary investment in information security." Bae said, "I hope a virtuous cycle will take hold in which information security investment becomes more active and the level of information security across the country rises."

The amendments are focused on expanding coverage. According to the renewed advance legislative notice, Article 8(1) of the decree deletes both the condition on designating and reporting a chief information security officer (CISO) and the condition of revenue of 300 billion won or more, and adds KOSPI- and KOSDAQ-listed corporations to those covered. According to the ministry's material on the 20th, special purpose acquisition companies (SPACs) are excluded. Those obliged to obtain information security management system (ISMS) certification under the Information and Communications Network Act as of the end of the previous year are newly added as Subparagraph 4 of the same paragraph. Article 8(2) is deleted, removing the exclusion conditions that had applied to public institutions, small enterprises, financial business operators and electronic financial business operators. The basis for calculating the number of users also changes from the daily average for the three months before the end of the previous year to the daily average for the entire previous year.

The ministry said it would issue "information security disclosure guidelines" reflecting the amendments and provide consulting support for companies newly subject to the obligation. It will also run ongoing online consultation and training, along with regional visiting training sessions. The reasons for enactment and amendment in the renewed advance notice include an explanation that the change aims to overcome public anxiety heightened by recent hacking incidents and raise national information security capabilities. In a January 9 press release, the ministry summarized the gist of the amendment as "deletion of the revenue criterion for listed companies, inclusion of information security management system (ISMS)-certified companies and abolition of exception provisions," and its purpose as "encouraging companies' voluntary security investment and strengthening the guarantee of the public's right to know." The same day, Choi Woo-hyuk, head of the ministry's Network Policy Office, said, "With this institutional improvement, we are now able to check the information security status of more companies than before."

KT, found to have 'no particular issues' in emergency inspection, came up at countermeasures briefing two months later

Discussion of expanding disclosure picked up speed after major incidents. A ministry official said in Korea Policy Briefing material on August 11 last year, "Following the SKT breach, we conducted emergency on-site inspections through this week of other telecom carriers such as KT and LGU+ and major platform companies such as Naver, Kakao, Coupang and Woowa Brothers, and no particular issues were found."

At the comprehensive plan briefing held a little over two months later, an incident at KT, one of the companies inspected, came up in questions. A reporter asked, "I understand that the recent problem with KT femtocells also ultimately occurred because KT failed to dispose of all of them." Vice Minister Ryu Je-myung answered regarding femtocells, "One thing, the problem of retrieval, retrieving them, is not easy." Ryu also said, "In connection with the KT incident, for small payments we are going to eliminate doing it with just SMS or ARS authentication as is done now." The Lotte Card incident was also raised in the same question-and-answer session.

The remedies the government put forward were expanded inspections and expanded disclosure. The Korea Policy Briefing material said, "To relieve widespread anxiety about hacking, we will immediately push for a large-scale security vulnerability inspection of some 1,600 IT systems used by the majority of the public, including in the public, financial and telecommunications sectors." Secretary General Shin Jin-chang said inspections of 260 financial sector systems among them would be completed by the end of that month. The expansion of mandatory disclosure was included in this package of measures, but the enforcement decree that serves as its legal basis passed the Cabinet meeting on the 20th of this month, nearly a year after the briefing.

The same plan contained several tasks aimed at companies that suffered incidents. The government said it would "expand the government's investigative authority so that the government can swiftly investigate sites even without a report once it secures signs of hacking." ISMS and ISMS-P certification audits would shift to on-site audits, and certifications would be revoked if serious defects occur at certified companies. It also said it would ease consumers' burden of proof if hacking occurs due to a company's security negligence and would review creating a fund that uses penalty surcharge revenue from personal information leaks for victim support and other purposes. Strengthening CEO responsibility and the role of the CISO was also on the list of tasks. At the briefing, 900 major companies and 260 financial institutions among the roughly 1,600 inspection targets were mentioned, and one reporter asked a question citing a figure of 228 public institution infrastructure facilities.