New cybersecurity rules tighten grip on businesses

Industry welcomes stronger cyber defenses but fears excessive liability could undermine business confidence, innovation
South Korean Vice Prime Minister and Science and ICT Minister Bae Kyung-hoon (center right) speaks during a press briefing in Seoul on Wednesday. (Yonhap)
The Korean government on Wednesday unveiled a sweeping set of cybersecurity measures aimed at preventing hacking and data leaks, following a string of major breaches at telecommunications and financial firms.
Though the plan underscores national urgency, it is already drawing concern from industry officials who say it shifts too much responsibility — and risk — onto the private sector.
Led by the National Security Office, the initiative brings together key ministries, including the Ministry of Science and ICT, to overhaul critical IT systems that serve the public. It also includes efforts to foster cybersecurity talent and strengthen domestic defense capabilities.
The government described the plan as an immediate action roadmap, promising to release a long-term national security strategy later this year.
‘Relevant ministries will closely monitor the implementation of these measures to ensure their effectiveness,’ Science Minister Bae Kyung-hoon said during a briefing. ‘The government will remain fully committed to building a resilient information security framework that supports Korea’s rise as a global AI leader.’
Under the plan, authorities will conduct large-scale inspections of about 1,600 key IT systems, spanning public infrastructure, central and local government networks, financial institutions, and major telecom and platform companies. Firms will be required to produce detailed user protection manuals, while the National Intelligence Service will share its investigative and forensic tools with the private sector.
An AI-powered digital forensic system will also be introduced to cut analysis time from 14 days to five, and telecom operators will face unannounced simulated hacking tests.
The government is also considering creating a fund sourced from penalties imposed for data breaches to compensate victims and strengthen personal data protection.
However, businesses warn that the measures could have unintended consequences by exposing them to heavier penalties, legal liabilities and compliance costs.
The new rules would expand government authority to launch investigations even without company reports, increase fines for delayed disclosures or repeated data leaks, and introduce punitive surcharges for firms that fail to meet prevention standards.
CEOs could also face direct accountability under proposed legal revisions, while chief information security officers would gain broader powers, including independent control of security budgets and mandatory reporting to corporate boards.
‘While stronger accountability is important, these measures risk overcorrecting,’ said one industry official who requested anonymity. ‘If companies are punished for every breach, even those caused by sophisticated global attacks, it could discourage digital investment and innovation.’
Critics argue that the plan reinforces a compliance-heavy approach that puts the onus of national cybersecurity on individual firms, rather than establishing a centralized, coordinated defense network.
‘The government needs a unified national control tower that can coordinate with companies, not just penalize them,’ another official said. ‘Cyber threats are increasingly global, and no single company can defend alone.’
Some also question the scope of enforcement, as direct on-site inspections may apply only to firms operating within Korea, potentially creating disparities between local and multinational companies. Others warn of operational disruptions, such as communication outages, if existing network equipment must be removed for testing.
Despite the pushback, officials maintain that the reforms are necessary to restore public confidence following a series of data breaches at major telecom and financial institutions.
Yet the debate highlights a growing tension between cybersecurity enforcement and business competitiveness — and how far the government should go in holding companies accountable for an increasingly borderless threat.