Regulations Governing Establishment of Internal Control Systems by Public Companies Article 9-1

A public company shall allocate adequate human resources and equipment for the planning and monitoring of the information security system and the implementation of information security management operations. If certain conditions are met, the FSC may order the company to appoint a person with overall responsibility for the promotion of information security policies and the deployment of related resources to serve on a concurrent basis as chief information security officer, and to establish a dedicated information security unit, chief officer, and other personnel.The certain condition referred to in the preceding paragraph shall be prescribed by the FSC.