South Korea extends information security disclosure duty to all listed firms from 2027

The Ministry of Science and ICT said that an amendment to the enforcement decree of the Act on the Promotion of the Information Security Industry passed a cabinet meeting on 20 October. The amendment widens the group of organisations that must make information security disclosures. Newsis reported that the amended decree takes effect on 1 January 2027, while other outlets said the duty applies from next year. [ 1 , 2 , 3 , 4 ]

Until now only listed companies with annual revenue of 300 billion won or more had to disclose. The amendment removes that requirement, so every company listed on KOSPI and KOSDAQ falls under the duty regardless of revenue. Newsis and Hankook Ilbo said SPACs are excluded. [ 1 , 2 , 3 , 4 ]

The decree also deletes the exemptions for public institutions, small enterprises, financial companies and electronic financial business operators. Companies required to hold ISMS certification are added to the disclosure group. Hankook Ilbo said ISMS certification is required of information and communications companies with prior-year revenue of 10 billion won or more and 1 million or more average daily users. Small enterprises under the Framework Act on Small and Medium Enterprises decree will be covered from 1 January 2029, with the ministry citing their management conditions. [ 1 , 2 , 3 , 4 ]

The way users are counted to decide who must disclose also changes. The old basis was the average daily number of users in the three months before the end of the previous year. The new basis is the average daily number of users over the whole previous year. [ 1 , 2 , 3 , 4 ]

Information security disclosure is a system in which companies publish their information security investment, staffing, and related certifications, assessments and inspections. Newsis said it was introduced in 2022 and was run mainly for large companies meeting thresholds such as revenue and user numbers. [ 1 , 2 , 4 ]

Seoul Economic Daily, Newsis and Hankook Ilbo described the change as a follow-up to the cross-ministry information security plan announced in October last year. Newsis, Hankook Ilbo and Kyunghyang Shinmun linked it to a series of cyber incidents. The government has said it aims to close blind spots in the disclosure system and to get companies to see information security as an investment, not a cost. [ 1 , 2 , 3 , 4 ]

To help newly covered companies, the ministry plans to provide a disclosure guideline reflecting the changes, along with consulting and counselling and education support. Newsis and Kyunghyang Shinmun said this includes online counselling and regional visit education. Minister Bae Kyung-hoon, who is also deputy prime minister, said disclosure is "an important system" that guarantees the public's right to know and encourages voluntary security investment by companies. He said he hopes the wider scope will lead to a virtuous cycle of more investment and a higher national level of information security. [ 2 , 3 , 4 ]