CISO · CPO · Chief Information Security Officer and Chief Privacy Officer
Chief Information Security Officer and Chief Privacy Officer
What is a CISO?
- The role that decides who answers when an incident happens
- Check the latest laws for who is covered, dual roles, and qualification requirements
- Report and policy updates are often missed after executive reshuffles
What changes when you appoint a CISO and a CPO is 'who answers when a security incident happens.' Before appointment, the IT team lead handles security on the side and HR or legal takes privacy case by case, so when an incident hits it takes a day just to find the person accountable. Once both roles are set, the person who approves security policy, receives incident reports, and notifies the authorities is one individual, and requests for training, audits, and budget go up under that person’s name. The starting point of the design is that the two roles cover different things, so one person cannot always hold both.
The CISO role is grounded in Korea’s Information and Communications Network Act, and the CPO role in the Personal Information Protection Act. The CISO protects information assets as a whole, from hacking and data leaks to system outages. Information and communications service providers that meet certain criteria must appoint one and report it to the Ministry of Science and ICT. The CPO handles the privacy policy, the lawfulness of collecting, using, and destroying personal data, and safeguarding data subjects’ rights. In effect, most businesses that process personal data must appoint one. The company size at which a dedicated executive is required, whether the role can be combined with other duties, and what qualifications or experience are needed have changed several times through legal amendments, so check the latest notices and the competent authority’s guidance.
Training and HR departments connect to these roles in two ways. First, the annual privacy training and information security training must have plans and results on record under the CPO’s and CISO’s names, so even if the training team designs the courses, the CPO and CISO are the ones who approve and keep the records. Second, HR data is the most sensitive personal data in the company, so retention and destruction standards for hiring, evaluation, and exit records should be set together with the CPO. When the executives in charge of CISO and CPO change in the December reshuffle, update the report filing and the officer’s name in internal policies as well. Missing this is often cited in inspections.
The most common failure in practice is appointing someone in name only. If the CISO on record is a sales executive who has never received a security report, then in an incident the fact that “the responsible officer didn’t know” becomes the bigger problem. The opposite confusion also occurs: a company that is not subject to the rule wrongly believes it must appoint one and hurriedly promotes an outside hire to executive. It is also common to hand both roles to one person automatically and run into dual-role restrictions, or to assign responsibility without the authority to request security budget and staff. The right order is to first confirm which law and which requirements apply to your company, and only then choose the people.
Seolyeong ParkA generative AI and AX training expert with 17 years of hands-on experience and 200+ sessions, who gets non-specialists using AI right away
Jungmi AhnSkin and beauty research and training specialistThe CISO role emerged in US companies in the mid-1990s as a dedicated executive for information security. In Korea it became a legal position when the Information and Communications Network Act introduced the designation and reporting system for the Chief Information Security Officer. The CPO role took hold when the Personal Information Protection Act required the designation of a privacy officer, and the scope and requirements of both systems have been amended several times.
Consider a hypothetical case. Company A has 210 employees and runs an online store with 480,000 members. On paper, its CFO held both the CISO and CPO roles. An internal security review in October found “no record of receiving security reports,” and ahead of the December executive reshuffle, the CEO ordered the company to redesign its accountability structure.
- Team Lead Yoon of Management Support first got legal advice on which requirements Company A meets under the Information and Communications Network Act and the Personal Information Protection Act. The answer: based on its member count, both roles must be appointed.
- The CFO admitted, “I look at the numbers, but I have never received a single security report.” In the December reshuffle, the CEO decided to appoint the head of IT as CISO and the legal director as CPO, splitting the two roles.
- Within two weeks of the appointments, the company filed the change to its CISO registration with the competent authority. On the same day, it updated the officer’s name and contact details in the internal information security policy and the privacy policy.
- The training team changed its form so that next year’s privacy training plan goes up for CPO approval. The HR team worked with the CPO to redo the destruction standards for departed employees’ HR records, classifying 9 of the 27 retained items for destruction.
- After formalizing quarterly security reporting, the CISO received reports on 14 security issues in the first year, none of which required notifying the authorities, and in the following year’s external audit, findings related to the responsible officer fell from 3 to 0.