Why the Disclosure Obligation Is Expanding to All Listed Companies
On January 9, 2026, the Ministry of Science and ICT (MSIT) issued advance notice of an amendment to the Enforcement Decree of the Act on the Promotion of the Information Security Industry, with a comment period running from January 9 to February 19. The core change is to remove the "revenue of KRW 300 billion or more" condition for listed companies, making every KOSPI- and KOSDAQ-listed corporation subject to mandatory information security disclosure.
Given that 693 companies were subject to mandatory disclosure in 2026, the scope would grow several times over. Note, however, that the amendment must still pass inter-ministerial consultation and review by the Ministry of Government Legislation, and application from the 2027 disclosure cycle remains the government's plan. The final promulgated text and the first filing deadline for newly covered companies should be confirmed through announcements from MSIT and the Korea Internet & Security Agency (KISA). Under the current system, obligated companies file through the Information Security Disclosure Portal by June 30 each year.
What Must Be Disclosed — Four Core Items
Failure to comply may result in an administrative fine of up to KRW 10 million.
The First Hurdles for KOSDAQ SMEs
IT and security budgets that are not separated in the books
At most small and mid-sized companies, security appliances, antivirus licenses, and monitoring service fees are buried in general IT expenses or service fees. To disclose, a company first needs account and asset classification rules that distinguish IT investment from information security investment.
Counting staff when no one is dedicated
Many companies rely on one or two IT staff who also handle security. In that case, the share of time spent on security work must be calculated with supporting evidence, which means job descriptions and work records need to back it up.
Reputational exposure from public figures
Disclosed figures are open to anyone. Because customers and investors will compare them against industry peers, consistency in how the numbers are calculated matters more than the numbers themselves.
A Roadmap Before the First Filing
Turning Disclosure into Certification and Sales Strength
The asset inventories, risk assessment results, and training and inspection records produced while building ISO 27001 or ISMS can be reused directly as disclosure material. Security assessments by large-company customers and public procurement requirements draw on the same data, so managing them together is more efficient. Government programs that support security consulting and security solutions for SMEs can also ease the initial cost burden.
Why Unlisted SMEs Should Pay Attention Too
Listed customers are increasingly asking suppliers for security-level documentation to support their own disclosure and supply chain management. Companies preparing for an IPO may also face the disclosure obligation soon after listing, so it is safer to start building records of security spending, staffing, and activities in advance.
KITIM Information Security and ISO Certification Consulting
KITIM links ISO 27001 implementation with information security disclosure readiness, supporting you from a current-state assessment to setting aggregation rules for investment and staffing data and organizing your evidence. If you are unsure where to begin before your first filing, please reach out through the consultation request form on the KITIM website. We will recommend a preparation plan suited to your company's size and industry.