ICT service providers to report cyber incidents within 24 hours of detection

2024.08.14. The Fair Economy — The Ministry of Science and ICT announced that the revised Act on Promotion of Information and Communications Network Utilization and Information Protection (Network Act), amended to ensure swift response to cyber breaches and secure the enforceability of measures needed to prevent their recurrence, will take effect on the 14th.

The current cyber security incident response system lacks clear criteria for the timing of reporting, leading to issues such as unreported or delayed reports of incidents, which have made it difficult to activate rapid on-site support. Additionally, while preventive measures such as strengthening security systems derived from incident cause analysis should serve as an opportunity to substantially improve the security level of ICT service providers that have experienced incidents, these measures are currently only "recommendations", resulting in reduced effectiveness of post-incident response.

To address these shortcomings, the ministry has reorganized the incident reporting system and stipulated in the Network Act and its enforcement decree a legal basis for orders to implement recurrence-prevention measures, methods for verifying compliance, and other provisions. This establishes an institutional foundation that enables ICT service providers to substantively strengthen their information protection levels.

A detailed review of the revised content shows that the incident reporting system has been reorganized.

When a cyber security incident occurs, prompt reporting is necessary to quickly contain the damage and receive expert support. Accordingly, ICT service providers that experience an incident must submit an initial report within 24 hours of becoming aware of the incident, covering the damage details, cause, and response status. Any additional information identified after the initial report must be submitted as a supplementary report within 24 hours of its discovery, ensuring that the initial report is not delayed due to incident cause analysis.

A legal basis for ordering measures to prevent recurrence of intrusions has been established.

In responding to cyber breaches, it is important not only to report swiftly but also to thoroughly carry out follow-up measures to prevent recurrence. Accordingly, the Ministry of Science and ICT established a legal basis allowing it to "order," rather than merely "recommend" as at present, that information and communication service providers affected by breaches implement necessary measures such as recurrence prevention. In addition, the ministry will check whether providers have complied with such orders, order corrective action on matters requiring supplementation, and impose administrative fines of up to 30 million won on providers that fail to comply with a corrective order.

Ryu Je-myeong, Director of Network Policy at the Ministry of Science and ICT, said, "Rapid reporting is essential to minimize the spread and recurrence of damage caused by cyber security incidents. The Ministry will strive to ensure that the incident reporting and follow-up system is properly established so that companies can receive various information security technical support."