The South Korean government, through several ministries including the Personal Information Protection Commission (PIPC), has announced a plan to strengthen accountability in cybersecurity within the public sector.

This plan was developed following the observation that recent security incidents, such as information leaks or ransomware infections, mostly resulted from non-compliance with fundamental security rules. The analysis also revealed that these breaches rarely led to sanctions and that sanctions primarily targeted operational staff rather than supervisors. Consequently, the government will establish clear guidelines to sanction violations of basic rules, such as failure to change initial passwords. For serious information leaks, the responsibility of supervisors will be formalized in texts such as the "Enforcement Regulation of the Disciplinary Ordinance for Public Officials" and disciplinary standards will be raised.

At the same time, the plan aims to improve institutional capabilities. The "Cybersecurity Status Assessment," conducted by the National Intelligence Service, will be expanded from 153 to over 2,000 public organizations by 2028 and will include new indicators. To prevent agents from avoiding these duties, incentive measures are under consideration, such as an information protection bonus or enhancements during performance evaluations. Finally, the project includes strengthening cybersecurity personnel, eventually creating dedicated units led by private sector experts, and implementing measures to ensure stable budgetary investment.