1. Reasons for Proposal
With the amendment of the Cloud Computing Act (hereinafter
referred to as the “Act”) (Promulgated on January 11, 2022; to be enforced on
January 12, 2023), the purpose of the amendment is to reflect the purpose of
the Act amendment by stipulating matters delegated to the Enforcement Decree of
the Cloud Computing Act.
2. Major Provisions
A. Establish security certification methods, procedures,
etc. (Article 15-2)
Prepare documents that a person who intends to obtain
security certification must submit to the evaluation agency, evaluation and
certification procedures and methods, etc.
B. Establish expiration date of security certification
(Article 15-3)
Stipulate the expiration date and renewal procedures of
the security-certified cloud computing service.
C. Establish certification mark and promotion of security
certification (Article 15-4)
Provide a basis for displaying the certification mark and
promoting the cloud computing service security certification.
D. Establish follow-up management of security
certification (Article 15-5)
The assessment agency stipulates the basis and procedures
for the follow-up evaluation of security-certified cloud computing services.
E. Establish security certification fees (Article 15-6)
Stipulate the basis for imposing fees for applicants for
the assessment agency’s security certification and calculation criteria for
those fees, support of fees for small and medium-sized enterprises, etc.
F. Establish criteria for the designation, management,
etc. of certification agencies and evaluation agencies (Article 15-7)
Stipulate the designation criteria, designation
procedures, expiration date, follow-up management, etc. of certification
agencies and evaluation agencies.
G. Establish the criteria for revocation of designation of
certification agencies and evaluation agencies (Article 15-8)
Prepare administrative disposition criteria for
cancellation of designation and suspension of business in the event of
violations by certification agencies and evaluation agencies.
H. Establish the business entrustment regulations, such as
designation of certification agencies and evaluation agencies, etc. (Article 20
(3) 5)
Prepare the basis for entrustment to the Korea Internet
& Security Agency of tasks determined by public notice among tasks related
to the designation, re-designation, cancellation of designation, etc. of
certification agencies and evaluation agencies.
