Duty LXD-7127
Runs an essential service, in South Korea
Information and Communications Infrastructure Protection Act, Notification of Cyber Security Incidentssince 2 lines
Act on the Protection of Information and Communications Infrastructure (정보통신기반 보호법, Act No. 6383, , as last amended by Act No. 20068, ), Arts. 13 and 14 · Read the law's page
- Notify a relevant administrative agency, an investigation agency or the Korea Internet and Security Agency when you recognize that a cyber security incident has disturbed, paralyzed or destroyed the designated infrastructure (Article 13(1)).
- Take swift measures to recover and protect the infrastructure after a cyber security incident, and comply with a recovery and protection order from the relevant central administrative agency (Article 14(1) and (2)).
- Applies to the head of an organization that manages information and communications infrastructure a central administrative agency has designated as critical information and communications infrastructure, which includes private operators and public bodies; reached by declaring that you operate an essential service.
Information and Communications Infrastructure Protection Act, Protection Measures and Vulnerability Analysissince 4 lines
Act on the Protection of Information and Communications Infrastructure (정보통신기반 보호법, Act No. 6383, , as last amended by Act No. 20068, ), Arts. 5, 8 to 11 and 30 · Read the law's page
- Formulate and implement physical and technological measures to protect the designated infrastructure, including incident prevention, backup and recovery, based on the outcome of the vulnerability analysis, and submit the measures to the relevant central administrative agency (Article 5(1) and (2)).
- Designate a chief information security officer in general charge of protecting the designated infrastructure (Article 5(4)).
- Analyze and evaluate the vulnerabilities of the designated infrastructure on a regular basis as the Presidential Decree prescribes, and when the agency orders it after a new form of electronic intrusion or a material change (Article 9(1) and (2)).
- Comply with the protection guidelines the relevant central administrative agency orders, and with its orders for further protective measures (Articles 10 and 11).
- Applies to the head of an organization that manages information and communications infrastructure a central administrative agency has designated as critical information and communications infrastructure, which includes private operators and public bodies; reached by declaring that you operate an essential service.
Information and Communications Network Act, Report on Computer Security Incidentssince 3 lines
Arts. 48-3 and 48-4 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (Act No. 20069, ) · Read the law's page
- Immediately report a computer security incident to the Minister of Science and ICT or to the Korea Internet and Security Agency upon discovering it; a report already made for the same incident under another statute satisfies this duty and need not be repeated.
- A person who operates an information and communications network, a provider of information and communications services included, must analyze the cause of the incident, respond based on the results of that analysis, and take measures to keep the resulting damage at bay (Article 48-4(1)).
- Preserve data when the Minister of Science and ICT orders it, and submit on the Minister's demand the data needed to analyze the incident's cause; submitting false data or refusing to submit it is separately finable, and failing to preserve data after an order to do so is a criminal offense (Article 73, item 6).
- The reporting and data duties below bind a provider of information and communications services, the Act's own broad term for a person who, for profit, provides information or acts as an intermediary in providing information using a telecommunications business operator's services, with no revenue or user threshold gating these duties; a separate certification duty in this Act binds only a designated information and communications service provider identified by revenue or user count and is not raised here. The cause-analysis duty in Article 48-4(1) reaches any person who operates an information and communications network, a provider included.