The revised 「Act on Promotion of Information and Communications Network Utilization and Information Protection」 (Network Act) and its Enforcement Decree, which comprehensively strengthen corporate responsibility for information protection from the prevention of cyber breaches through post-incident response and sanctions, take effect on October 1. Under the new legislation, companies that repeatedly neglect security will face strict economic sanctions, including fines.
 [코리안투데이] A view of the Ministry of Science and ICT building © 장형임 기자 |
The Ministry of Science and ICT (Deputy Prime Minister and Minister of Science and ICT Bae Kyung-hoon) announced on September 30 that the revised Network Act and its Enforcement Decree will take full effect on October 1. The core aim is to raise companies’ substantive accountability for information protection and to advance incident-prevention systems, while establishing an institutional framework to sanction companies that repeatedly neglect security.
This implementation is intended to back, through law and enforcement decree, the ‘Pan-Governmental Comprehensive Information Protection Measures’ announced in the wake of a series of major breaches last year. Earlier, the President had directed at a senior secretaries’ meeting and elsewhere that preparations be made ‘to ensure strong responses, including punitive fines, against companies that repeatedly suffer security incidents,’ and asked officials to ‘actively consider preemptive investigations and to work on institutional improvements to strengthen companies’ security capabilities.’ Accordingly, the Network Act revised this past March focused on strengthening the entire spectrum from breach prevention to response, and the Enforcement Decree now gives concrete shape to the matters delegated by the Act and the details needed for its implementation.
First, corporate information-protection governance is being strengthened. The status of the Chief Information Security Officer (CISO) is elevated from an employee to an executive, meaning that mid-sized enterprises and others must designate their CISO as an executive. However, in consideration of company size and staffing conditions, an exception allows small-to-medium enterprises to continue designating the head of an information-protection-related department as before. Companies newly required to designate a CISO as an executive are given a six-month grace period to ease the burden.
In addition, companies obligated to report a CISO must mandatorily establish and operate an information protection committee. Chaired by the CISO and composed of the heads of key departments such as IT development, personal information protection, human resources and finance, this committee deliberates on matters requiring company-wide coordination, such as securing information-protection budgets and personnel. The chair must report the deliberation results to the chief executive officer (CEO), and major matters must also be reported to the board of directors, so that information protection is treated not as the work of a single department but as a management-level task.
The effectiveness of the Information Security Management System (ISMS) certification scheme is also being enhanced. An ‘enhanced certification’ is newly introduced for operators whose breaches would have a large ripple effect on citizens’ daily lives. Enhanced certification applies, among those subject to mandatory certification, to ▴major telecommunications service providers such as carriers with annual revenue of 1 trillion won or more and integrated information and communications facility operators, ▴information and communications service providers with annual revenue of 3 trillion won or more, and ▴operators that have been subject to an investigation by the public-private joint investigation team or a fine within the past three years. In addition, certification audits—previously conducted selectively—are strengthened into a method combining document review and on-site review, and technical review such as vulnerability checks will be carried out for enhanced-certification targets and companies that have experienced incidents, ensuring substantive, field-centered audits.
Breach investigations and sanctions are also being toughened considerably. Where circumstances indicating a breach have been secured, a breach investigation review committee—which deliberates on the need for prompt government investigation—will be formally operated under the Ministry of Science and ICT. The committee comprises 15 members from the private and public sectors, including the chair, and the term of private-sector members is two years. Meetings are convened when the chair deems it necessary or when the Minister of Science and ICT requests one. On the sanctions side, operators that fail to comply with a government corrective order or a request to submit data will be subject to an enforcement penalty equal to 0.02% of their average daily revenue for each day of non-compliance. Furthermore, operators that cause repeated breaches through intent or gross negligence will be held to stringent economic accountability, with fines of up to 3% of relevant revenue depending on the severity of the incident.
This implementation places weight on protecting users, who—amid the routine use of telecommunications and online services—have borne the brunt of breaches such as personal data leaks and service outages. It is significant in that, by inducing companies to accept security as an ‘obligation’ rather than a ‘cost,’ it has laid the groundwork for citizens to use digital services more safely.
Deputy Prime Minister and Minister of Science and ICT Bae Kyung-hoon stated, ‘With the enforcement of this Network Act and its Enforcement Decree, an institutional foundation has been laid to further strengthen companies’ security awareness and accountability,’ adding, ‘We expect companies to recognize security not as a mere cost but as an essential element of management and to carry this forward through active investment, and the government will also actively support the settling-in of the system to create a digital environment that citizens can use with peace of mind.’
Related inquiries may be directed to the Cyber Incident Response Division of the Information Protection and Network Policy Bureau at the Ministry of Science and ICT (044-202-6460, 044-202-6468).
지역 홍보대사 신청 기자양성과정 신청 코리안투데이 지부장 신청 코리안투데이 인천강화코리안브랜드대상 신청 최고경영인대상 신청 소비자만족도대상 신청
<저작권자 ⓒ 코리안투데이(The Korean Today) 무단전재 및 재배포 금지>
