Cabinet approves amendment to Cybersecurity Industry Promotion Act enforcement decree

Revenue threshold of 300 billion won removed; all listed companies required to disclose

Move aims to protect public's right to know and encourage corporate cybersecurity investment

Ministry of Science and ICT. [Herald DB]
Ministry of Science and ICT. [Herald DB]

All listed companies will be required to disclose their cybersecurity activities starting next year, as the government moves to encourage greater corporate investment in information protection.

The Ministry of Science and ICT said Tuesday that the cabinet approved an amendment to the enforcement decree of the Act on the Promotion of the Information Security Industry, expanding the scope of mandatory cybersecurity disclosure.

The amendment is one of the follow-up measures under a cross-ministry comprehensive cybersecurity plan that relevant government agencies jointly announced after a series of cyberattacks last year. It was designed to close blind spots in the disclosure regime, protect the public's right to know and encourage companies to invest more in cybersecurity.

Under the Act on the Promotion of the Information Security Industry, the cybersecurity disclosure system requires companies to make public their investment and staffing in information security, as well as the status of related certifications, assessments, inspections and activities. The system has applied since 2022 to companies meeting certain criteria, including business sector, revenue and number of users.

The amended decree, which takes effect Jan. 1 next year, removes the previous requirement that listed companies have annual revenue of 300 billion won ($225 million) or more. All companies listed on the Kospi and Kosdaq markets will now be subject to the mandatory disclosure requirement regardless of revenue. Special purpose acquisition companies, or SPACs, are excluded.

The amendment also adds companies required to obtain Information Security Management System, or ISMS, certification as a new category of mandatory disclosure subjects. Exemptions that had previously applied to public institutions, small enterprises, financial companies and electronic financial service providers have also been removed.

However, small enterprises as defined under the enforcement decree of the Framework Act on Small and Medium Enterprises will be given a two-year grace period, with the disclosure obligation applying to them from Jan. 1, 2029, in consideration of their business conditions. The method for calculating user numbers will also change — from the daily average over the three months immediately preceding the end of the prior year to the daily average across the entire prior year.

The Ministry of Science and ICT also plans to provide a cybersecurity disclosure guideline to ease the compliance burden on newly covered companies. The ministry will offer ongoing online consultations and education support, along with regional outreach visits, to help companies better understand their disclosure obligations.

"Cybersecurity disclosure is an important system that protects the public's right to know and encourages companies to voluntarily invest in information security," Deputy Prime Minister and Minister of Science and ICT Bae Kyung-hoon said. "I hope this expansion of mandatory subjects will serve as an opportunity to further invigorate cybersecurity investment and establish a virtuous cycle in which the overall level of information security across the country improves."


ko@heraldcorp.com