The scope of mandatory information protection disclosure will be expanded to all listed companies starting January 1 next year. Information protection disclosure is a system that discloses a company's information protection investments and personnel, as well as the status of related certifications, evaluations, inspections, and activities.
The Ministry of Science and ICT said Tuesday that an amendment to the Enforcement Decree of the Act on Promotion of Information Protection Industry (hereinafter referred to as the "Enforcement Decree of the Information Protection Industry Act"), which expands the scope of mandatory information protection disclosure, was passed at the State Council meeting.
Accordingly, the requirement for mandatory information protection disclosure, previously limited to listed companies with annual sales of 300 billion won or more, will be removed, and all listed companies on the Korea Exchange (KOSPI) and KOSDAQ markets will be included in the mandatory disclosure scope regardless of their sales size.
Entities subject to mandatory Information Security Management System (ISMS) certification will be newly added to the mandatory disclosure scope, and exceptions previously granted to public institutional investors, small businesses, financial companies, electronic finance operators, and others will also be removed.
However, small businesses as defined under the "Enforcement Decree of the Basic Act on Small and Medium-sized Enterprises" will be subject to the disclosure obligation starting January 1, 2029, two years later, taking into account management conditions and other factors.
The criteria for calculating the number of users will also be changed from the daily average number of users over the three months preceding the end of the previous year to the daily average number of users for the entire previous year.
As the number of newly subject companies increases significantly, the Ministry of Science and ICT will provide an "Information Protection Disclosure GuideLINE" reflecting the amended content and offer consulting support.
In addition, to enhance companies' understanding of disclosure, the ministry plans to conduct ongoing online consultations and educational support, as well as regional visit education programs.
Meanwhile, this amendment to the enforcement decree is one of the follow-up measures to the "Comprehensive Information Protection Measures Across Ministries" jointly announced by relevant ministries in October last year, prompted by consecutive cyber intrusion incidents.
The initiative was launched to eliminate blind spots in the disclosure system and guarantee the public's right to know, while also encouraging companies to view information protection as an investment rather than a cost, thereby strengthening the nation's overall information protection capabilities.
Deputy Prime Minister and Minister of Science and ICT Bae Kyung-hoon stated, "Information protection disclosure is an important system that guarantees the public's right to know and encourages voluntary information protection investments by companies," adding, "We expect that this expansion of the mandatory scope will serve as a catalyst for further activation of information protection investments and the establishment of a virtuous cycle that raises the nation's overall level of information protection."
in TECH
