Mandatory information security disclosures for all KOSPI- and KOSDAQ-listed companies from next year

[Financial News] Starting in 2027, all companies listed on the KOSPI or KOSDAQ will be required to disclose information on their information security investments and staffing levels, regardless of revenue. The disclosure requirement will also be extended to financial companies and public institutions, which were previously exempt, broadening the scope of information made public about companies’ security investments.
The Ministry of Science and ICT said an amendment to the Enforcement Decree of the Act on the Promotion of the Information Security Industry, which expands the entities required to make information security disclosures, passed a Cabinet meeting on the 20th.
Information security disclosure is a system under which companies make public details such as the amount they invest in security, the size of their workforce, and their information security-related certifications, evaluations and inspection activities. It has been mandatory since 2022 for companies meeting certain requirements, such as thresholds for revenue or user numbers.
The key change is the removal of the requirement that listed companies have revenue of at least 300 billion won. As a result, all companies listed on the KOSPI or KOSDAQ, except special purpose acquisition companies (SPACs), will be subject to the disclosure requirement.
Entities required to obtain Information Security Management System (ISMS) certification will also newly be subject to the disclosure requirement. Provisions that previously exempted public institutions, financial companies, electronic financial businesses and small businesses, among others, will also be repealed.
However, to ease the management burden on small businesses, the requirement will be deferred for two years, until January 1, 2029. The method for calculating user numbers to determine whether disclosure is mandatory will also change: instead of using the average daily user count for the three months immediately preceding the end of the previous year, it will use the average daily user count for the entire previous year.
The amendment to the enforcement decree is a follow-up measure to the government’s Comprehensive Interagency Information Security Measures announced last October. In response to a series of cyber incidents, the measure aims to broaden the scope of the existing disclosure system and encourage companies to invest in information security.
To ease the burden on newly affected companies, the Ministry of Science and ICT plans to distribute disclosure guidelines reflecting the amendments and provide consulting support. It will also offer online consultations and training, as well as on-site training sessions on a regional tour.
Deputy Prime Minister and Minister of Science and ICT Bae Kyung-hoon said, “I hope that expanding the scope of entities subject to this requirement will further spur investment in information security and help establish a virtuous cycle that raises the level of information security across the country.”
[email protected] Choi Hye-rim Reporter