FSC Introduces Improvements to Cloud Computing and Network Separation Rules in Financial Sector

South Korea's Financial Services Commission (FSC)unveiled its plans to improve regulations on cloud computing and network separation in financial sectors on April 14. The financial industry has been raising concerns about difficulties in adopting and using new digital technologies as a result of excessive regulations on cloud computing and network separation. Therefore, in order to support the financial sectors' efforts for digital transformation in a stable manner, the authorities have introduced a set of measures to improve regulations on cloud computing and network separation. On cloud computing, the changes will focus on (a) clarifying the scope (and types) of work that can make use of cloud computing, (b) overhauling the usage process to remove redundancies and similarities and (c) making a transition from the current prior reporting requirement to ex post facto reporting. On network separation, the uniform application of the network separation rules will be eased in stages starting with the development and test servers.

Background

The acceleration of digital transformation in financial services has been pushing up demand for new digital technologies such as cloud computing, big data analytics and artificial intelligence (AI). However, there have been continuous complaints from the industry that the current regulations on data security in the financial sector regarding cloud computing and network separation have been too strict, thereby hindering the adoption and use of new digital technologies. In order to address this issue, after taking into account various opinions from the financial industry, the FSC has prepared the measures for improving regulations on the use of cloud computing and network separation to promote digital innovation in the financial industry.

Regulatory Improvements on the Use of Cloud computing

a) Clarifying assessment standards for determining the level of work significance for making use of cloud computing service

(Problem) When using cloud computing, an assessment should take place to determine the level of work significance, but it has been indicated that the assessment standards have been rather unclear. Under the current regulation, the level of work significance is determined by the factors such as the handling of personal credit information and whether it has grave impact on the safety and reliability of electronic financial transactions, but there have been difficulties in terms of its applicability in practice.

(Solution) The authorities will prepare a more detailed set of standards for assessing the level of work significance while taking into account examples from overseas. The assessment for the level of work significance will be determined through a deliberation by financial companies' internal data protection committee.

b) Reducing the number of assessment criteria for cloud service providers (CSPs) from 141 to 54 criteria

(Problem) Financial companies are required to conduct a soundness and stability assessment on the cloud service provider prior to using a cloud computing service. The current assessment comprises of too many criteria, up to 141 in total with overlapping items, posing the utmost burden on financial companies throughout the whole process.

(Solution) The authorities have made a simplification and reduced the number of CSP assessment criteria down to 54 in total that are made up of 16 essential criteria and 38 alternate criteria. For non-essential types of work, a further simplification is provided with financial companies being required to carry out assessment on CSPs on only the 16 essential criteria.

c) Differentiating the process for cloud computing usage based on the level of work significance

(Problem) Currently, even the types of work that have been classified as back office functions (non-essential types of work) also need to abide by the same usage process as those that have been classified as front office functions (essential types of work). As such, even though financial companies can freely make adjustments on certain criteria for non-essential types of work in their business continuity plans, in practice, the non-essential types of work have been treated in a similar way as the essential types of work.

(Solution) The authorities will ease the usage process for making use of cloud computing service for non-essential types of work by lifting some portions of the CSP assessment requirements. The authorities will also introduce separate standards for non-essential types of work when establishing business continuity plans and safety assurance measures in order to make a clear procedural distinction between essential types of work and non-essential types of work.

d) Introducing a uniform assessment system on CSPs to reduce burdens on financial companies

(Problem) Currently, when financial companies "A" and "B" wish to use cloud computing service provided by a CSP "a," financial companies "A" and "B" each have to make an assessment on the CSP "a" separately. The problem of procedural inefficiency has been identified in this regard.

(Solution) A uniform CSP assessment will be carried out by the Financial Security Institute (FSI) representing financial companies, the result of which can be used by financial companies "A" and "B" alike.

e) Drawing up a distinctive set of assessment standards for SaaS

(Problem) The current CSP assessment criteria are not readily fit for assessing Software as a Service (SaaS) applications that have gained more traction for use recently.

(Solution) The authorities will prepare a separate set of assessment criteria for SaaS businesses in a similar way as the cloud security assurance program (CSAP).

f) Simplifying the paperwork required for submission such as the "work consignment operational standards"

(Problem) In order for financial companies to make use of cloud computing, the industry has made complaints that the paperwork required for submission is redundant and excessive. Currently, the "work consignment operational standards" that financial companies need to submit when using cloud computing are posing burdens as there exists redundancy with the items also reflected in their "business continuity plans."

(Solution)  The authorities will simplify the redundancy and similarity to help ease financial companies' burdens of preparing and submitting the necessary paperwork.

g) Making a transition from the current requirement of prior reporting to an ex post factor reporting for the use of cloud computing

(Problem) Currently, financial companies are required to report to the Financial Supervisory Service when they need to use cloud computing for essential work seven business days prior to the day of the use. However, this reporting rule has been identified as undesirable for the purpose of timeliness.

(Solution) This prior reporting rule will be changed to an ex post facto reporting requirement for using cloud computing. When signing an outsourcing contract for using cloud computing service for essential types of work or when a significant change takes place in their existing contracts, financial companies will be required to report that change within three months from the signing or change taking place.

Regulatory Improvements on Network Separation

a) Exemption of network separation rules for development and test servers

(Problem) With the uniform application of the physical network separation rule on development and test servers which do not hold personal credit information and thus have relatively lower level of importance in electronic financial transactions, there has been concern about low efficiency for development and test environment.

(Solution) For development and test servers, an exemption will be granted for easing the physical network separation rule. However, supplemental measures will be taken to minimize potential malware attacks and require additional control measures for data protection.

b) Exemption of network separation rules for non-electronic financial work and SaaS

(Problem) There has been continuous call for the need to ease the network separation rule for the types of work that are not relevant to electronic financial transactions and for the operating systems that do not handle information about customers and their transactions such as information systems that provide support for business management including personnel management and groupware and other related systems. The network separation rule has been a source of inconvenience when using Software as a Service (SaaS) applications even for non-essential types of work.

(Solution) Through the financial regulatory sandbox program, the authorities will grant an exemption for the physical network separation requirement for the types of work that are not relevant to electronic financial transactions and those that do not handle information about customers and their transactions. For non-essential types of work, the authorities will permit the use of SaaS applications in an internal company network.

c) Step-by-step deregulation of network separation over medium to long term

(Problem) Currently, the network separation rule is applied uniformly regardless of the scope of the work of financial companies. For instance, asset management businesses that do not necessarily hold information about their customers but focus solely on managing their assets are subject to the equivalent level of network separation rule as banks even though the need for such regulation is relatively lower for asset management businesses vis-à-vis other financial companies.

(Solution) Over a medium to long term, the authorities will seek deregulation of network separation after reviewing certain conditions such as ensuring accountability from financial companies and strengthening security oversight by the FSI. Deregulatory measures will focus on (a) downsizing the types of work that are subject to the network separation rule and (b) granting financial companies an option to choose network separation in both physical and logical terms.