Information Security Disclosure Companies' Investment Increased by 15.7%... Samsung Electronics Leads in Investment Scale

Ministry of Science and ICT, Information Security Disclosure Status Analysis Report
Investment and Dedicated Personnel Up 15% and 13% Year-on-Year
Samsung and KT Ranked 1st and 2nd in Investment and Dedicated Personnel

This year’s investment amount by companies disclosing information security data increased by 15.7% compared to last year, totaling 2.1196 trillion KRW. Among all companies, Samsung Electronics and KT ranked first and second respectively in terms of information security investment scale and dedicated personnel.

Source=Ministry of Science and ICT

On the 22nd, the Ministry of Science and ICT announced the "2024 Information Security Disclosure Status Analysis Report." Since December 2021, the government has mandated disclosure to promote safe internet use for users and to encourage companies to expand their information security investments by publicly managing the information security status of companies.

There are 655 companies subject to mandatory disclosure, including Internet Service Providers (ISP), Internet Data Centers (IDC), tertiary general hospitals, cloud computing providers, companies required to appoint Chief Information Security Officers (CISO), and businesses with annual sales exceeding 300 billion KRW and an average daily user count of over 1 million.

Source=Ministry of Science and ICT

The report analyzed information security investment amounts, dedicated personnel, certifications, and security activities of a total of 746 companies that disclosed this year. The total investment amount (2.1196 trillion KRW) and dedicated personnel (7,681.4 people) of all disclosed companies increased by 15.7% and 13.9% respectively compared to the previous year. The average investment amount (2.9 billion KRW) and average dedicated personnel (10.5 people) also rose by 11% and 9.4% respectively year-on-year. The Ministry of Science and ICT evaluated that since the information security disclosure system became mandatory, companies have expanded their investments to strengthen their information security capabilities on their own.

The number of voluntary disclosure companies also increased from 63 last year to 91 this year. With the spread of Environmental, Social, and Governance (ESG) management and the strengthening of corporate social responsibility regarding information security, the number of voluntary disclosure companies is also rising.

By industry, the average investment amount was highest in finance (7.6 billion KRW), followed by information and communications (5.9 billion KRW), and wholesale and retail (2.7 billion KRW), all showing increases compared to the previous year. The average dedicated personnel was highest in information and communications (24.7 people), finance (21.0 people), and wholesale and retail (9.1 people), while transportation and rental service industries saw a slight decrease in average dedicated personnel compared to last year.

Top 10 Companies by Information Security Investment Scale / Data from Ministry of Science and ICT

The scale of information security investment was led by Samsung Electronics (297.4 billion KRW), KT (121.8 billion KRW), and Coupang (66.0 billion KRW), with half of the top 10 companies belonging to the information and communications industry. Dedicated personnel rankings were also led by Samsung Electronics (957.4 people) and KT (336.6 people), followed by Samsung SDS (331.6 people). Additionally, companies that conducted various information security activities showed higher average investment amounts and dedicated personnel than those that did not engage in such activities.

The Ministry of Science and ICT and the Korea Internet & Security Agency selected 100 companies for verification, focusing on those whose information security investment and dedicated personnel ratios were 20% or more of their IT investment and personnel, or those that disclosed for the first time or delayed disclosure. As a result, disclosures from a total of 96 companies were corrected.

Voluntary disclosure companies can receive a 30% discount on fees for Information Security Management System (ISMS) and Personal Information Protection Management System (ISMS-P) certifications, and excellent information disclosure companies are granted benefits such as government awards and additional points for participation in government information security projects.

Ryu Jae-myung, Director of the Network Policy Office at the Ministry of Science and ICT, stated, "We confirmed through the voluntary expansion of information security investments that the information security disclosure system contributes to improving companies’ information security levels." He added, "The government will provide accurate information to users through verification of disclosure contents and asks CISOs and management to pay attention and make efforts so that users can use services with confidence."