Growing Hacking Concerns... Only Five Construction Firms Hold Information Security Certification

Five Firms Including SK Ecoplant Hold ISMS-P Certification
Only Three Certified for Sales Information—Lack of Industry Attention
Hacking Response Training Rate at 60%—Lowest Among All Sectors

It has been found that only three construction companies in Korea have obtained the "Information Security Management System - Personal Information Protection (ISMS-P)" certification with coverage that includes sales information. Amid renewed concerns over personal data leaks following a series of consecutive bank sector hacking incidents, the construction industry is also facing criticism for inadequate security systems.

According to an investigation by The Asia Business Daily on October 7 into the ISMS-P certification status from the Korea Internet & Security Agency (KISA) among major domestic construction companies, five firms—SK Ecoplant, Samsung C&T, GS Engineering & Construction, POSCO E&C, and Lotte Engineering & Construction—currently maintain the certification.

Of these, only three—SK Ecoplant, POSCO E&C, and Lotte Engineering & Construction—include sales or related information within the certified coverage. SK Ecoplant is certified for sales, occupancy, and after-sales service; POSCO E&C for sales management and customer support services; and Lotte Engineering & Construction for sales and rental system operations.

The other two companies, Samsung C&T and GS Engineering & Construction, are certified for their brand websites—Raemian and its official Homepage for Samsung C&T, and for customer service operations such as XI and XI HOME, as well as operations of the Elysian Gangchon and Jeju resort services for GS Engineering & Construction.

The ISMS-P certification is Korea's most authoritative integrated certification in information security and personal data protection. Evaluation bodies such as the Korea Association for ICT Promotion (KAIT) and the Open Privacy Alliance (OPA) audit companies’ security measures and activities, after which KISA and the Financial Security Institute (FSI) grant the certification.

Currently, there are 1,280 certified entities, including Samsung Electronics, LG Electronics, and Korean Air, with the certification valid for three years. While holding ISMS-P certification does not completely guarantee safety against hacking threats, it is regarded as a minimum benchmark demonstrating a company’s efforts toward information security.

Until now, information security issues in the construction industry had not been as prominent as in the financial or retail sectors. However, with the increasing adoption of artificial intelligence (AI) technology at construction sites and growing importance of personal information in sales and rental businesses, concerns over potential incidents are mounting.

According to last year’s information security disclosure analysis by KISA, Samsung C&T had the highest security investment in the construction sector at 14.6 billion won, followed by DL E&C (2.8 billion won), Daewoo E&C (1.8 billion won), Lotte Engineering & Construction (1.5 billion won), and IPARK Hyundai Development Company (900 million won), all remaining below 3 billion won.

The average number of dedicated information security personnel in the construction sector was only 3.4, ranking at the lowest among all industries. In particular, the ratio of companies conducting training to respond to ransomware and hacking threats was 60% in construction, the lowest figure among all sectors, compared to 82.5% in wholesale and retail, 78.9% in manufacturing, and 77.4% in finance and insurance.

A KISA official stated, "ISMS-P certification indicates that a company has reached a certain standard in security. Because security is often overlooked when there are no incidents, many believe the return on investment is low, but sustained attention is needed."

This content was produced with the assistance of AI translation services.