[Exclusive] Security management to factor into performance bonuses as the Ministry of Science and ICT steps up evaluations

[Financial News] The Ministry of Science and ICT, the lead government agency responsible for responding to cyber incidents, is strengthening accountability for cybersecurity in its internal performance evaluations. It plans to make cybersecurity items account for at least 5% of performance evaluations for individual civil servants as well as departments, and to increase the points allocated to information security. Amid a growing focus on the importance of security management following a series of cyber incidents, the aim is to extend responsibility for security from the departments in charge to the entire organization and link it to performance bonuses, thereby strengthening a security management system focused on prevention.
According to industry sources on the 26th, the Ministry of Science and ICT plans to allocate at least 5% of both departmental and individual performance evaluations to cybersecurity-related items under its “2026 Integrated Performance Evaluation Operating Plan.” The ministry intends to tighten evaluation criteria in areas found wanting in last year’s Administrative Management Capacity Evaluation and Cybersecurity Status Evaluation, and ensure that security management performance is reflected in actual performance evaluations.
In departmental evaluations, the points allocated to administrative management capacity and individual evaluation factors will be doubled, from 10 to 20. These evaluation factors include IT- and information security-related items, such as strengthening IT capabilities and improving cybersecurity. The measure is intended to increase the impact of security management performance on departmental evaluation results.
Notably, cybersecurity evaluations will also be linked to individual civil servants’ performance scores. Security work, previously managed mainly by departments responsible for IT and security, will be brought into the performance management framework for the entire organization. As a result, inadequate security management could affect the evaluation results of individuals as well as the departments concerned.
The Ministry of Science and ICT plans to finalize the performance evaluation overhaul soon and reflect the results in bonus payments next April, following departmental and individual evaluations.
The overhaul is seen as an effort to increase the entire organization’s responsibility not only for investigating and responding to cyber incidents after they occur, but also for routine security management and prevention. The Ministry of Science and ICT has also been strengthening its response framework, including by establishing a Cyber Incident Investigation Team last December to handle investigations and responses to cyber incidents.
The need to strengthen security management is also evident in evaluations of government agencies. In the “2025 Cybersecurity Status Evaluation” conducted by the National Intelligence Service across 152 organizations, including central government ministries, metropolitan and provincial governments, and public institutions, not a single central government ministry or metropolitan or provincial government received an “Excellent” rating. The Ministry of Science and ICT, which is responsible for cybersecurity policy, received only an “Average” rating.
As cyber incidents continue to occur in sectors closely tied to people’s daily lives, including telecommunications, platforms, and finance, calls are growing to strengthen the security capabilities of government agencies themselves. Security vulnerabilities have recently been disclosed in PHP, a web programming language, and Node.js, a server-side JavaScript runtime, highlighting the importance of ongoing vulnerability management and security checks across both the public and private sectors.
However, it remains unclear whether the new evaluation framework, which gives greater weight to security, will actually strengthen security capabilities. If penalties tied to evaluation results are given too much emphasis, they could instead discourage people from actively reporting or sharing security issues. There are growing calls for institutions to continue strengthening security measures—including expanding security staffing and budgets and implementing vulnerability fixes—in parallel with revising evaluation criteria. “This is an effort to improve accountability and the ability to carry out security management across the organization, rather than leaving it solely to the departments responsible for security,” an industry official said.
[email protected] Jang Min-kwon Reporter