Starting next year, the mandatory information security disclosure requirement, previously applicable only to listed companies with sales exceeding 300 billion won, will be expanded to include all listed companies.
The Ministry of Science and ICT announced that the amendment to the Enforcement Decree of the Information Protection Industry Act was approved by the Cabinet on October 20.
This amendment is part of follow-up measures to the comprehensive information security plan announced by relevant ministries last October. It aims to eliminate gaps in the disclosure system and encourage companies to view information security as an investment rather than a cost.
First, the scope of mandatory information security disclosure will be expanded. The sales threshold of 300 billion won will be removed, making all listed companies in the KOSPI and KOSDAQ markets subject to disclosure requirements.
Additionally, entities required to obtain Information Security Management System (ISMS) certification will now also be included in the disclosure obligations. Exceptions for public institutions, small businesses, financial companies, and electronic financial service providers, which were previously excluded, will be eliminated.
However, small businesses will be subject to the disclosure requirements starting January 1, 2029, considering their management conditions.
The criteria for calculating the number of users will also change from the average daily number of users over the last three months of the previous year to the average daily number of users for the entire previous year.
The Ministry of Science and ICT plans to provide a 'Information Security Disclosure Guidelines' to ease the burden of compliance for newly obligated companies. Additionally, it will offer ongoing online consultations and training support, as well as regional training visits to enhance companies' understanding of disclosure requirements.
Deputy Prime Minister and Minister of Science and ICT Lee Yong-ho expressed hope that the expansion of mandatory disclosure will stimulate investment in information security and establish a virtuous cycle that enhances the overall level of information security in the country.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.