Enforcement Rules of the Cyber Security Management Act Article 10

The scope of core businesses referred to in the Subparagraph 1, Paragraph 1 of the preceding article shall be as follows:1. For government agencies, business that can be reasonably determined as falling within their coreresponsibilities and authority based on their organizational regulations.2. Business necessary for each agency to operate, maintain, or provide critical infrastructure.3. The primary services or functions of public enterprises, specific foundations, and government-con trolled enterprises, organizations, or institutions.4. Business operations of agencies involving the matters specified in Subparagraphs 1 to 5, Article 4, or Subparagraphs 1 to 5, Article 5 of the Regulations on Classification of Cyber Security Responsibility Levels.The core information and communication system referred to in Subparagraph 6, Paragraph 1 of the preceding article refers to a system necessary to support the continuity of core business operations, or any system determined to have a high required defense level according to the provisions of Appendix 9, Principles for Classifying Protection Requirement Levels for Information and Communication Systems, of the Regulations Governing the Classification of Cyber Security Responsibility Levels.