SEOUL, October 20 (AJP)— South Korea will require all companies listed on the KOSPI and KOSDAQ to publicly disclose their cybersecurity spending, staffing and related activities from 2027, regardless of their revenue.
The Ministry of Science and ICT (MSIT) said Tuesday that the Cabinet approved revisions to the Enforcement Decree of the Act on the Promotion of Information Security Industry, expanding mandatory information security disclosures to companies and public institutions previously exempt from the requirements. The changes will take effect on Jan. 1, 2027.
Under the revised rules, the government will eliminate the existing requirement that listed companies have annual revenue of at least 300 billion won to fall under the disclosure mandate. All KOSPI- and KOSDAQ-listed companies, except special purpose acquisition companies (SPACs), will be covered regardless of revenue.
Organizations required to obtain Information Security Management System (ISMS) certification, which verifies whether companies have adequate cybersecurity management practices in place will also be subject to the disclosure requirements. The revised rules will remove existing exemptions for public institutions, financial companies, electronic financial service providers and small businesses. Small businesses will be given an additional two years to prepare, with the requirements taking effect on Jan. 1, 2029.
South Korea made cybersecurity reporting mandatory in 2022 for businesses meeting certain criteria based on industry, revenue or user numbers. The system requires companies to disclose their cybersecurity investments, dedicated security personnel and information about certifications, assessments, inspections and other security-related activities.
The latest revision follows a series of cyberattacks and forms part of a government-wide information security plan announced in October 2025. It aims to close gaps in corporate disclosure requirements, improve public access to information about cybersecurity preparedness and encourage businesses to treat security spending as a long-term investment rather than simply a cost.
The government will also revise how user numbers are calculated to determine which companies must disclose their cybersecurity information. Instead of averaging daily users over the final three months of the previous year, the new rules will use the average daily number of users for the entire previous year.
To help newly covered organizations comply, MSIT plans to provide updated disclosure guidelines and consulting services, along with year-round online consultations, training programs and regional educational sessions.
Copyright ⓒ Aju Press All rights reserved.
