South KoreaInformation and Communications Network Act, Report on Computer Security Incidents
Arts. 48-3 and 48-4 of the Act on Promotion of Information and Communications Network Utilization and Information Protection Etc. (Act No. 20069, )
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Security, Reporting
What it requires
- This binds a provider of information and communications services, the Act's own broad term for a person who, for profit, provides information or acts as an intermediary in providing information using a telecommunications business operator's services, with no revenue or user threshold gating this particular duty; a separate certification duty in this Act binds only a designated information and communications service provider identified by revenue or user count and is not raised here.
- Immediately report a computer security incident to the Minister of Science and ICT or to the Korea Internet and Security Agency upon discovering it; a report already made for the same incident under another statute satisfies this duty and need not be repeated.NIST CSF 2.0RS.CO-02
- Analyze the cause of the incident, respond based on the results of that analysis, and take measures to keep the resulting damage at bay.NIST CSF 2.0RS.AN-03NIST CSF 2.0RS.MI-01
- Preserve, and submit on demand to the Minister of Science and ICT or the Korea Internet and Security Agency, the data needed to analyze the incident's cause; submitting false data or refusing to submit it is separately finable.NIST CSF 2.0RS.AN-07
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- RS.AN-03Analysis is performed to establish what has taken place during an incident and the root cause of the incident
- RS.AN-07Incident data and metadata are collected, and their integrity and provenance are preserved
- RS.CO-02Internal and external stakeholders are notified of incidents
- RS.MI-01Incidents are contained
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Failing to report an incident or to submit demanded data is enforced only as an administrative fine under Article 76(1); no provision reviewed here makes either failure, standing alone, a criminal offense.
Penalty structure
Shared cap for every Article 76(1) violation in its list, including failing to report a computer security incident (Art. 48-3(1)) and failing to submit, or submitting false, data demanded under Art. 48-4(5).
- Rule
- Fixed only
- As of
- Currency
- KRW
- Fixed cap
- 30,000,000
Who enforces it
Enforcement body
The Minister of Science and ICT, supported by the Korea Internet and Security Agency (KISA); the Korea Communications Commission holds a parallel corrective-order power over related provisions of the same Act.
Settledness
- As of
- Open questions
- A Network Act amendment (Bill No. 14896) is reported to have been promulgated and to take effect , expanding the Chief Information Security Officer's duties and adding an information-security-level assessment system effective : does it also change the Art. 48-3/48-4 incident-reporting clock or threshold?
What this law does
A provider of information and communications services, a person who for profit provides information or acts as an intermediary in providing information using a telecommunications business operator's services, must immediately report a computer security incident to the Minister of Science and ICT or the Korea Internet and Security Agency (KISA) upon discovering it; a report already made for the same incident under another statute satisfies this duty.
The same class of person must then analyze the cause of the incident, respond based on that analysis, and take measures to keep the resulting damage at bay, and must preserve or submit the data the Minister or KISA demands for that analysis when ordered to. Failing to report the incident, or failing to submit the demanded data or submitting false data, is an administrative fine of up to KRW 30,000,000.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, handles health records, provides financial services, runs an essential service, is a listed company, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .