Summary

  • South Korea's cabinet approved an amended information-security decree on 20 October. From 1 January 2027, mandatory public security disclosure will cover public institutions, compulsory ISMS certification subjects and KOSPI and KOSDAQ listed companies regardless of revenue, with special-purpose acquisition companies excluded.
  • Small businesses receive until 1 January 2029. The disclosures describe security investment, personnel, certifications, assessments, inspections and activities.

An exemption can be a wonderfully comfortable piece of office furniture. South Korea's government has decided to remove several of them from its cybersecurity disclosure scheme. The Ministry of Science and ICT's original announcement, issued after the cabinet decision on 20 October, says public institutions, financial companies and electronic financial businesses will lose exclusions that had kept them outside the mandatory pool. Public bodies entrusted with other people's data and services will have to put their security arrangements on the public record.

The same decree removes the 300 billion won revenue test for listed companies. KOSPI and KOSDAQ firms enter regardless of sales, except special-purpose acquisition companies. Organisations already required to hold Information Security Management System certification also join the disclosure pool. The package takes effect on 1 January 2027; small businesses under the relevant small-business decree get a two-year delay to 1 January 2029. The distinction matters: the rule widens the door next year, while one group has longer to prepare.

The disclosure itself concerns information-security investment and staff, plus certifications, evaluations, inspections and security activities. This is a public inventory of inputs and processes. That inventory creates a useful question for every institution that calls digital service essential: who is paying for its protection, and who is doing the work? A glossy assurance statement is easier to write than a staffing figure.

There is a less obvious change in the counting rule. Where the user threshold applies, average daily users will be calculated over the whole previous year, replacing a measure based on the last three months of that year. A business whose traffic swings seasonally may cross the line differently under the new calendar. The ministry says it will issue revised guidance, offer consulting and run online and regional training for newly covered organisations.

The original release supplies the categories and dates, but no projected count of newly covered bodies or estimate of new security spending. The first disclosure cycle will show the actual size of the enlarged pool. What has already changed is the allocation of visibility: public institutions and smaller listed firms can no longer assume their organisational label or revenue bracket keeps the security ledger out of view.

Sources