All Listed Companies Required to Disclose Information Security from Next Year, Regardless of Revenue

Amendment to Enforcement Decree of the Act on the Promotion of the Information Security Industry Approved
All Listed Companies and Entities Required to Obtain ISMS Certification Included
Disclosure Exemptions Abolished for Public Institutions, Finan

The government will expand the scope of companies required to disclose their information security practices to include all listed companies, encouraging businesses to invest in security and strengthening information security capabilities nationwide.

The Ministry of Science and ICT said an amendment to the Enforcement Decree of the Act on the Promotion of the Information Security Industry was approved at a Cabinet meeting on October 20.

The amendment is one of the follow-up measures to the “Comprehensive Interagency Information Security Plan,” announced jointly by relevant ministries in October 2025 in response to a series of cyber incidents. It aims to close gaps in the information security disclosure system and encourage businesses to view information security as an investment rather than a cost, thereby strengthening information security capabilities nationwide.

Information security disclosure is a system under the Act on the Promotion of the Information Security Industry through which companies disclose information on their information security investments and personnel, as well as related certifications, assessments, inspections and activities. Since 2022, companies meeting certain criteria, such as business sector, revenue and number of users, have been required to make these disclosures.

Under the amendment, which takes effect next year, the existing requirement of “revenue of KRW 300 billion or more” will be eliminated, and the disclosure obligation will be expanded to cover all companies listed on the KOSPI and KOSDAQ markets. Companies required to obtain Information Security Management System (ISMS) certification, public institutions, small businesses, financial companies and electronic financial service providers will also be added to the list of entities required to disclose.

However, under the Enforcement Decree of the Framework Act on Small and Medium Enterprises, the requirement for small businesses will be deferred until January 1, 2029. The standard for calculating the number of users will also change from the average daily number of users over the three months immediately preceding the end of the previous year to the average daily number of users over the entire previous year.

The Ministry of Science and ICT plans to provide an “Information Security Disclosure Guideline” and consulting services to ease the compliance burden on newly covered companies. It will also offer ongoing online consultations, training support and regional outreach training.

Bae Kyunghoon, Deputy Prime Minister and Minister of Science and ICT, said, “Information security disclosure is an important system that guarantees the public’s right to know and encourages companies to invest voluntarily in information security. We hope that expanding the scope of entities required to disclose will further boost investment in information security and establish a virtuous cycle that raises information security standards nationwide.”

This content was produced with the assistance of AI translation services.