From next year, mandatory cybersecurity disclosures will be expanded to all companies listed on the KOSPI and KOSDAQ. Public institutions and financial companies, previously exempt from disclosure requirements, will also be included.

The Ministry of Science and ICT said a revision to the enforcement decree of the Act on the Promotion of the Information Security Industry, containing the changes, passed a Cabinet meeting on Monday.

The revision is a follow-up measure to the pan-government cybersecurity comprehensive measures announced jointly by relevant ministries in October last year. Cybersecurity disclosure is a system under which companies publish their cybersecurity investment and staffing, as well as the status of related certifications, evaluations, inspections and activities. It has been mandatory since 2022 for companies meeting certain criteria, including business sector, revenue and number of users.

The key change is the expansion of entities subject to mandatory disclosure. The revision removes the existing requirement of annual revenue of at least 300 billion won that applied to listed companies, expanding the scope to all listed corporations on the KOSPI and KOSDAQ regardless of revenue. Special purpose acquisition companies will be excluded. Those required to obtain Information Security Management System certification will also be newly included. Exception provisions excluding public institutions, small businesses, financial companies and electronic financial business operators will also be removed.

Small businesses, however, will be subject to the disclosure requirement from Jan. 1, 2029, taking into account management conditions. The criteria for calculating the number of users will also change from the daily average number of users over the three months immediately before the end of the previous year to the daily average number of users over the entire previous year.

The ministry plans to provide cybersecurity disclosure guidelines reflecting the revision and support consulting to reduce the burden on newly covered companies. It will also offer always-available online consultations and training, along with regional visiting training sessions. The revised enforcement decree will take effect from Jan. 1, 2027.

Bae Kyung-hoon (배경훈), deputy prime minister and minister of science and ICT, said he expects the expanded scope of mandatory coverage to serve as a catalyst for more active cybersecurity investment and for a virtuous cycle to take hold that raises the overall level of national cybersecurity.