Korean firms consider stricter accountability and oversight checks under responsibility maps following a wave of data breaches
South Korean financial firms are considering tighter cybersecurity oversight for senior executives next year, including more detailed security responsibilities and compliance checks, as a wave of data breaches puts pressure on corporate leadership to strengthen internal controls.
The proposed measures would go beyond assigning cybersecurity tasks on paper, placing greater emphasis on how executives monitor security risks, to demonstrate that they are fulfilling their obligations under the country's responsibility map system.
According to an accounting industry official Thursday, financial institutions are exploring the measures as potential internal projects for 2027, although no formal revisions or requests for outside consulting have been made.
"Financial firms are expected to strengthen executives' information security duties and oversight systems next year," the official said. "We haven't received any formal requests yet, but understand that companies are considering such projects internally."
Introduced in July 2024, the responsibility map system requires financial institutions to assign specific internal control and risk management duties to individual executives, making it easier to determine accountability when failures occur.
The latest discussions focus on making those obligations more specific and strengthening checks on whether executives are properly carrying them out, rather than overhauling the existing framework.
A central issue is how to divide cybersecurity accountability between chief information security officers, who oversee security operations, and CEOs, who bear broader responsibility for organizational oversight.
Under the approach being considered, CISOs would remain directly responsible for information security functions, while CEOs would be expected to ensure that executives properly manage risks and maintain effective internal controls.
Recent breaches at KB Kookmin Bank, Hana Bank and BNK Busan Bank have added urgency to the discussions.
"Recent security incidents across the financial sector have prompted us to review how executives fulfill their responsibilities," a banking industry official said.
"We are closely reviewing key areas, including oversight of external service providers and outsourced vendors, system access controls, detection of unusual activity and incident response procedures," the official added.
A securities industry official said the company was reviewing its responsibility maps through an internal task force rather than establishing a separate cybersecurity team.
"Security and internal control will remain key issues for financial firms," the official said. "We expect executives' related duties to be strengthened further next year."
The industry discussions come as regulators signal tougher scrutiny of cybersecurity governance.
At a meeting Thursday chaired by Financial Services Commission Chairman Lee Eog-weon, the regulator said 37 financial firms had reported 40 cybersecurity incidents over the past month, affecting approximately 473,000 records.
No leaks involving information that could enable fraudulent payments, such as passwords, have been identified so far. However, some smaller cryptocurrency exchanges and other financial service providers reported thefts of funds under their management.
The FSC said it would examine external access points across financial firms' IT systems and assess whether their internal controls are functioning effectively.
It also plans to review whether senior executives have fulfilled their assigned cybersecurity responsibilities and require immediate corrective measures where necessary.
ch0221@heraldcorp.com
