## Key points from the source Korea's Ministry of Science and ICT announced Cabinet approval of an amendment to the Enforcement Decree of the Information Security Industry Promotion Act. From 2027, mandatory cybersecurity disclosure will cover all listed corporations and entities required to obtain Information Security Management System (ISMS) certification, and existing exemptions will be removed. The stated aims are to strengthen the public's right to information and encourage voluntary corporate investment in cybersecurity. ## TABS Company's business perspective Companies that may fall within scope should assign disclosure ownership and approval responsibilities during 2026 and establish repeatable evidence collection for cybersecurity investment, staffing, certifications, and activities. Listed companies, IPO candidates, and mandatory ISMS entities can reduce last-minute gaps by having finance, legal, and security teams map each disclosure data point to its owner and supporting records. Source: Ministry of Science and ICT, “Mandatory Cybersecurity Disclosure to Expand to All Listed Companies and Others from 2027,” 20 October 2026. This article is a summary and adaptation with attribution under the Korea Open Government License Type 1.