The Board Has Ultimate Responsibility for 'IT Risk'... FSS Establishes Related Guidelines

Key IT Service Providers to Undergo Risk Assessments at Least Twice a Year
Establishing Management Standards for the Entire Outsourcing Process

From now on, the board of directors will bear ultimate responsibility for IT risks that arise when financial companies use external IT services such as cloud computing. For key IT service providers that have a significant impact on the company's operations or financial consumers, the company will be required to assess risks semi-annually.

On July 29, the Financial Supervisory Service announced that it had developed the "Third-Party IT Risk Management Guideline" together with the Korea Federation of Banks, Korea Financial Investment Association, Korea Life Insurance Association, General Insurance Association of Korea, Credit Finance Association, Korea Federation of Savings Banks, and Korea Fintech Industry Association.

Recently, financial companies have been utilizing external IT services such as cloud computing and SaaS, and concerns have been raised that service disruptions, hacking, or personal information leaks could lead to damage for financial consumers.

First, it stipulates that the board of directors will have ultimate responsibility for third-party IT risk management. As a result, management will be responsible for establishing and operating a third-party IT risk management system. To this end, a central management department must be designated to establish and implement security measures and emergency response actions, ensure safety, and centrally manage the status of outsourced information processing work across all business units, as well as assess the adequacy of third-party IT risks and outsourcing contracts.

Based on this, financial companies are required to establish a three-tier control system consisting of a central management department, risk management department, and internal audit department. The central management department will be responsible for managing outsourcing arrangements and assessing both the adequacy of outsourcing contracts and third-party IT risks.

Methods for identifying and managing third-party IT risks have also been made more specific. Financial companies must review the financial soundness of outsourcing providers, the services provided, the types and volume of information processed, encryption methods, incident response systems, and IT facilities. These reviews must be conducted semi-annually to keep related information up to date. In particular, "key third parties" that have a significant impact on financial company operations or financial consumers should be separately designated for enhanced risk management. If risk assessments uncover risks that cannot be controlled or mitigated, remedial measures should be implemented first, and if the risks still cannot be resolved, the contract should be suspended or the board should decide whether to maintain the contract.

Risk management procedures for each stage of the contract have also been systematized. Before signing a contract, onsite due diligence must be performed to verify the service capabilities and information protection systems of the service provider, and the contract must specify roles and responsibilities in the event of an incident. During the contract period, the status of contract fulfillment should be checked at least once a year, emergency response and backup management systems must be established, and exit strategies should be developed in preparation for contract termination. After the contract ends, information assets should be returned, access rights must be revoked, and all outsourced information should be completely destroyed.

This guideline will operate as a "soft rule," allowing financial companies to apply it at their own discretion based on the importance of the work and the risk level. The Financial Supervisory Service stated that, based on this guideline, each industry association plans to establish and implement best practices starting in November. However, the actual timing of implementation may be adjusted depending on the readiness of each sector. In addition, the Financial Supervisory Service announced that it will continue to promote proactive supervision measures for digital risks.

This content was produced with the assistance of AI translation services.