[2022 National Audit] "Amazon and MS Benefit" from Cloud Security Certification Grade System Reform

At the National Assembly's Science, Technology, Information and Broadcasting Committee's audit of the Ministry of Science and ICT held on the 4th, concerns were raised about foreign companies encroaching on the public sector cloud market due to the government's restructuring of the Cloud Security Assurance Program (CSAP) grading system. The photo shows Vice Minister Park Yoon-kyu responding to a question from Representative Yoon Young-chan of the Democratic Party of Korea. Photo by Naver TV capture

[Asia Economy Reporter Cha Min-young] At the National Assembly Science, Technology, Information and Broadcasting and Communications Committee's audit of the Ministry of Science and ICT held on the 4th, concerns were raised about foreign companies encroaching on the public sector cloud market due to the government's restructuring of the Cloud Security Assurance Program (CSAP) into a graded system.

Earlier, the government officially announced on August 18th through a briefing that the CSAP system would be reorganized into a graded system. The existing system, which was classified by type, will be restructured into three levels: high, medium, and low. However, the details will be specifically discussed and finalized by the Digital Platform Government Committee.

Park Chan-dae, a member of the Democratic Party of Korea who raised questions during the audit, stated, "Until March of this year, public sector clouds were required to obtain CSAP certification, but under the Yoon Seok-yeol administration, there have been talks about relaxing CSAP requirements." He pointed out, "It is expected that beneficiaries of the relaxed certification will be Amazon, Microsoft (MS), Google, Oracle, and others, and these companies are actively trying to enter the public market."

He added, "Doesn't this mean that foreign companies will also be allowed? Because the various CSAP certification stages were strict for companies providing public sector cloud services, foreign companies were previously excluded, but the result is that they are now allowed."

He continued, "Foreign companies dominate 80% of the domestic cloud service market," and questioned, "Due to CSAP standards, foreign companies have not entered the public sector cloud market, but isn't the government planning to lift that restriction?" He emphasized that this is an area requiring physical control.

Park also asked, "Was this an official request from the U.S. side following the May Korea-U.S. summit?" and pressed, "The U.S. Chamber of Commerce has been continuously proposing this."

Yoon Young-chan, also from the Democratic Party, raised similar questions. He said, "The Ministry of Science and ICT claims that the CSAP restructuring was requested by the industry, but this is only the assertion of some companies, including foreign ones," and raised his voice, saying, "Do not distort public opinion."

He added, "The actual discussions accelerated after the Prime Minister attended a regulatory improvement meeting on June 17 and mentioned the issue," and criticized, "The Ministry of Science and ICT started internal reviews around that time, and inter-ministerial consultations with the Ministry of the Interior and Safety and others were not well coordinated. Why is the Ministry of Science and ICT recklessly pushing an issue that could allow overseas operators to dominate the domestic cloud market?"

In response, the Ministry of Science and ICT drew a line, stating that the system improvement is not intended to give preferential treatment to foreign companies. They explained that the improvement was pursued based on industry requests gathered through field meetings and meetings with software (SW) companies.

Deputy Minister Park Yoon-kyu said, "The CSAP improvement is based on industry requests because the previous standards were uniform," and added, "We set the direction to change to security standards based on data importance, like advanced countries such as the U.S., not targeting specific foreign companies."

He further explained, "In the domestic cloud market, there are infrastructure providers called Infrastructure as a Service (IaaS) companies, but there are also many software companies growing globally through Software as a Service (SaaS) on top of that."

He added, "Domestic companies can also benefit, and we will discuss with the Digital Platform Government Committee to ensure that domestic companies do not suffer disadvantages."

Minister Lee Jong-ho also accepted the criticism from Representative Yoon Young-chan, who asked, "Is the Ministry of Science and ICT, which should promote domestic companies, going in the opposite direction?" by saying, "I understand."