


Starting in 2027, the system has been revised to greatly expand the scope of mandatory information security disclosure. According to the government’s draft enforcement decree, the existing standard of “listed companies with sales of at least 300 billion won” will be removed, and all KOSPI and KOSDAQ listed companies, as well as firms required to obtain ISMS certification, will be included among the disclosure obligations. It also removes the exceptions for public institutions, financial companies, small businesses, and electronic financial business operators.
A large number of companies will be making their first disclosure in 2027. The problem is that doing it well in the first year is harder than it sounds.
Recently, the Korea Internet & Security Agency (KISA) conducted practical training on 2026 information security disclosure. Based on that training, this summarizes how to prepare for the first disclosure in 2027.
The reason the first disclosure is difficult is ‘data linkage’
Companies preparing security disclosure for the first time usually run into the same problem.
The security team says it carried out security activities. The accounting team does not know which account the costs were booked to.
The HR team does not know how to calculate dedicated security personnel. The IT team gets confused about whether server, cloud, and solution costs belong under information technology investment or information security investment. The disclosure manager must decide whether this can be made public externally.
In the end, the issue is not whether 'security was done' but whether security activities can be linked to disclosable figures and supporting evidence.
This is also emphasized in KISA's practical training on information security disclosure. To calculate investment amounts, an asset ledger, expense ledger, and labor cost data are needed. To derive personnel status, an organization chart, duty assignment table, job description, and withholding tax-related data are needed.
In other words, information security disclosure is not a document the security team can draft alone. The CISO, security team, IT team, accounting team, HR team, and disclosure manager must work together.
Companies making their first disclosure in 2027 must rehearse this year
Even companies that are not mandatory subjects as of 2026 should not feel safe. If they are in the expanded scope in 2027, this year is effectively the last rehearsal period.
The rehearsal does not need to be grand. A single internal mock disclosure based on this year’s disclosure template is enough.
We estimate how much our company invests in information technology and, within that, how much is invested in information security. We check how many dedicated information security personnel can be recognized. We sort out which of activities such as ISMS, ISO 27001, mock hacking, security training, cyber insurance, and vulnerability checks can be used in disclosures. Then we verify whether there is supporting evidence for all of them. Once you do this, the gaps become obvious.
“We made security investments, but they are hard to find in the accounting records.”
“We have security staff, but it is unclear whether they count as dedicated personnel.”
“We did the training, but there are no attendance records.”
“We conducted mock hacking, but the results report has not been organized.”
If you first discover this problem in June 2027, disclosure quality will suffer. If you discover it in 2026, you still have time to fix it.
The key is ‘verifiable disclosure’
The most notable change in the 2026 practical training is that methods for reviewing accounting consistency, data calculation procedures, practical cautions, and case studies were emphasized more. Going forward, information security disclosures are moving beyond simple input to verification-ready disclosures. It means a disclosure that can explain ‘why this number was produced.’
If you entered an information security investment amount, it must be verified against the expense ledger and asset register. If you entered information security staff, it must be explained with the organization chart and duty assignment table. If you entered security training, there must be training materials and attendance records. If you entered a mock hacking test, there must be a contract, results, and remediation details. If you entered a certification, the certificate and validity period must be confirmed.
Information security investment: ‘classified correctly’ rather than ‘spent a lot’
The item CEOs are most likely to confuse is the information security investment amount.
From a CEO's perspective, you may want to see all equipment or services bought for security as information security investment. But in practice, the standard is not that simple.
IT investment is viewed broadly. Information security investment is viewed narrowly and conservatively. Products with clear security functions, such as firewalls, VPNs, DLP, and encryption solutions, can be recognized as information security investment.
By contrast, ordinary servers bought to run EDR, simple network-isolated PCs, standard VDI, and general backup equipment are hard to recognize as information security investment. That is because the product itself does not perform a security function. The key criterion here is not ‘why it was bought’. It is what function the product or service actually performs.
Companies disclosing for the first time in 2027 must organize accounting accounts and security functions together starting this year. It is not enough for the security team to say it was bought ‘for security purposes.’ The expense must be identifiable in the accounting records, and that expense must be linked to information security functions.
The numbers in the disclosure and the accounting records must match.
Information security disclosure figures must match the company's accounting records.
Information security spending must not be estimated from the security team's memory. It must be linked to the audit report, trial balance, asset register, and expense ledger. If the company uses ERP, it should also decide in advance how to extract journal data.
When reviewing the expense ledger, do not look only at SG&A. IT and security costs may also be in cost-of-sales entries. Which accounts contain outsourced security monitoring, cloud security services, security equipment maintenance, and security consulting costs varies by company.
Companies making their first disclosure in 2027 should sort out the following questions with the accounting team this year.
Which accounts hold our company's IT and security costs? How can we separate assets and expenses?
How do we distinguish assets for security purposes from general IT assets? How do we prove the share of security work within outsourced service fees?
If you cannot answer these questions, the disclosure figures will be unstable.
Need dedicated information security staff
Estimating information security staffing is also an item first-disclosure companies often get wrong.
In many companies, one person does many jobs. They handle IT operations, monitor security equipment, do personal data protection work, and respond to incidents. This structure is common in mid-sized and small companies.
But in disclosures, roles are judged strictly. To be recognized as dedicated information security staff, they must work solely on information security. If they do both IT and security work, it is hard to be recognized as dedicated information security staff.
The same applies to outsourced staff. Saying only, 'We use a security monitoring vendor' is not enough. You must be able to explain it with the contract, quotation, scope of work, and input man-hours.
Companies making their first disclosure in 2027 should review their organization chart again this year. They need to sort out who the security person really is, whether they are dedicated or concurrent, and how far outsourced work goes. This task should be done together by HR and the security team.
Information security disclosure is not a simple report; it is an organizational diagnosis.
For certification and activity, the standard is not 'done' but 'there is a record'
Information security disclosures also include certifications, assessments, inspections, and activity status.
Certifications such as ISMS, ISMS-P, and ISO 27001 are typical examples. Activities such as security inspections, penetration testing, employee security training, security campaigns, cyber insurance enrollment, vulnerability disclosure and reward programs, and zero-trust checks may also be included in the disclosure.
What you can say you did and what you can disclose are different.
If you gave training, you need training materials and attendance records. If you did penetration testing, you need the contract and the results report. If you enrolled in cyber insurance, you need the policy certificate. If you performed a vulnerability check, you need the findings and follow-up actions.
A disclosure is not a document written from memory.It is a document written from records.
Roadmap for Companies’ First Disclosure Preparation in 2027
Companies that must make their first information security disclosure in 2027 should begin preparing in phases from now.
Timing | Preparation task | Question for the CEO to check |
First half of 2026 | Check eligibility and regulatory changes | Is our company likely to be included among the new 2027 target entities |
Second half of 2026 | Conduct an internal mock disclosure | Have you calculated investment, staff, and activities once based on this year’s figures |
End of 2026 | Organize accounting, HR, and security data | Are the cost ledger, asset register, org chart, and role assignment table connected |
Q1 2027 | Finalize supporting documents and review pre-checks | Can you explain it if the verifier asks |
Q2 2027 | Draft the final disclosure and have the CEO review | Is it accurate enough to be made public externally |
End of June 2027 | Submit the disclosure | Are you prepared to respond to post-submission verification after filing |
The first disclosure does not begin in June. You need to prepare at least six months in advance, ideally a year ahead.
The first disclosure is a public test that reveals the company’s security system
A company making its first information security disclosure in 2027 is not simply complying with one more new regulation. It is experiencing the first public release of its security system to the market.
A disclosure does not improve just by being well packaged. A good disclosure comes from good security management.
Security investments must be documented. Security staffing must be explained. Security activities must be evidenced.
Accounting records and disclosure figures must match. Management must know this process.
If you become a disclosure subject company next year, this year is your time to rehearse. Do not miss this chance to strengthen your company's security while also building disclosure readiness.

Popular Articles






