South Korean banks consider tighter executive cyber oversight
South Korea’s financial sector is evaluating enhanced cybersecurity accountability for top executives, with plans to implement stricter security obligations and compliance audits. The push follows a series of high-profile data breaches that have intensified demands for stronger leadership oversight.
The proposed framework would shift focus toward verifying how executives actively oversee security risks, ensuring compliance with the country’s responsibility map system, launched in July 2024. This system mandates that financial institutions assign clear cybersecurity and risk management duties to individual leaders, clarifying individual accountability.
A key debate revolves around clarifying roles between chief information security officers (CISOs) and CEOs. Under the approach being considered, CISOs would retain direct responsibility for information security functions, while CEOs would be expected to ensure that executives properly manage risks and maintain effective internal controls.
Recent incidents at KB Kookmin Bank, Hana Bank, and BNK Busan Bank have accelerated these discussions. A banking industry official noted, “Recent security incidents across the financial sector have prompted us to review how executives fulfill their responsibilities.”
Read Also: Hanjin Chair Boosts Stake in Korean Air Parent
The regulatory push coincides with heightened scrutiny from authorities. At a meeting chaired by Financial Services Commission Chairman Lee Eog-weon, officials disclosed that 37 financial firms reported 40 cybersecurity incidents over the past month, compromising roughly 473,000 records.
The FSC will now inspect external access vulnerabilities in firms’ IT infrastructure and evaluate whether existing controls operate as intended. It will also review whether senior executives have fulfilled their assigned cybersecurity responsibilities, enforcing immediate corrective measures where necessary.
Financial firms are expected to strengthen executives’ information security duties and oversight systems next year, according to an accounting industry official. The official stated, “We haven’t received any formal requests yet, but understand that companies are considering such projects internally.”
A securities industry official said their company was reviewing its responsibility maps through an internal task force rather than establishing a separate cybersecurity team.
