South KoreaInformation and Communications Infrastructure Protection Act, Protection Measures and Vulnerability Analysis
Act on the Protection of Information and Communications Infrastructure (정보통신기반 보호법, Act No. 6383, , as last amended by Act No… . 20068, ), Arts. 5, 8 to 11 and 30
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to the head of an organization that manages information and communications infrastructure a central administrative agency has designated as critical information and communications infrastructure, which includes private operators and public bodies; reached by declaring that you operate an essential service.
- Formulate and implement physical and technological measures to protect the designated infrastructure, including incident prevention, backup and recovery, based on the outcome of the vulnerability analysis, and submit the measures to the relevant central administrative agency (Article 5(1) and (2)).
- Designate a chief information security officer in general charge of protecting the designated infrastructure (Article 5(4)).
- Analyze and evaluate the vulnerabilities of the designated infrastructure on a regular basis as the Presidential Decree prescribes, and when the agency orders it after a new form of electronic intrusion or a material change (Article 9(1) and (2)).
- Comply with the protection guidelines the relevant central administrative agency orders, and with its orders for further protective measures (Articles 10 and 11).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 30(1) sets administrative fines of up to 50 million won for failing to comply with an Article 10(1) order or an Article 14(2) or (3) recovery order.
- Rule
- Fixed only
- As of
- Currency
- KRW
- Fixed cap
- 50,000,000
Who enforces it
Enforcement body
The head of the relevant central administrative agency, who designates the infrastructure, issues guidelines and orders, and imposes the administrative fines.
Settledness
- As of
- Open questions
- Is a given customer a management organization, a status each central administrative agency decides case by case and the Act alone does not settle?
What this law does
Article 8(1) of the Act lets the head of a central administrative agency designate information and communications infrastructure under its jurisdiction as critical information and communications infrastructure. Article 5(1) requires the head of the organization that manages critical information and communications infrastructure to formulate and implement physical and technological protection measures, including incident prevention, backup and recovery.
Article 5(4) requires that head to designate a chief information security officer. Article 9(1) requires that head to analyze and evaluate the infrastructure's vulnerabilities on a regular basis as prescribed by Presidential Decree. Article 10 lets the relevant central administrative agency issue protection guidelines and order the management organization to comply with them.
Article 11(1) lets the relevant central administrative agency order a management organization to take further protective measures after reviewing its submitted measures. Article 30(1) sets an administrative fine of up to 50 million won for failing to comply with an order under Article 10(1) or with a recovery and protection order under Article 14. The Act entered into force on . The amendments of enter into force one year after their promulgation.
When LexLint raises it
When your app profile says your app runs an essential service.