Specific Inquiry
As permission under the financial supervisory regulations for financial companies to use the public cloud has expanded, there are many issues concerning the cloud computing usage report that financial companies are required to file under the supervisory regulations. In addition, as the Financial Services Commission released the “Improvement Plan for Cloud and Network Separation Regulations in the Financial Sector” as of the current date (2022.04.15), in order to promote new technology and the use of cloud, several substantial changes to the Regulation on Supervision of Electronic Financial Transactions are expected. The material below records points that can be referred to as practical responses to major issues that arose while providing operational support at financial client project sites.
(However, this is written from a practitioner’s perspective rather than as a legal interpretation from a lawyer’s perspective, and it should be read with that in mind.)
1. Must a usage report also be filed when development cloud is used during the development stage?
1) Article 14-2 (Procedures for Using Cloud Computing Services, etc.), paragraph 3, of the Regulation on Supervision of Electronic Financial Transactions is defined as follows.
... A report shall be made to the Governor of the Financial Supervisory Service ..... in the form prescribed by the Governor of the Financial Supervisory Service, at least 7 business days before the date on which the cloud computing service is actually to be used.
Under the requirement above, this is interpreted as requiring a report.
2) At most project sites, however, the contract is to be signed at the production stage, and the development environment uses the cloud without a contract in most cases, so the documents required for a usage report cannot be assembled.
Moreover, to conform to the current regulation, which has the character of a prior report for using the cloud, a report must be filed at least twice for a single project (once when the cloud is used for development and once when it is used for production), except where the work is a simple solution implementation. It is therefore a requirement on which a perfect score of 100 is hard to achieve (?).
3) From the standpoint of a financial company supervised by a higher authority, the following response is needed in preparation for supervision by that authority, such as a comprehensive audit or a sector audit.
If circumstances permit and the submission documents can be prepared, file a usage report at the development stage and again at the production stage, for two filings. Otherwise, obtain two deliberations and resolutions of the internal information protection committee (one item on cloud use on the development network and one item on cloud use on the production network).
If both are difficult…… there seems to be little choice but to wish them luck.
4) This issue will be resolved next year, because the supervisory regulation is scheduled to change to ex post reporting.
The current supervisory regulation takes the form of reporting cloud use in advance, along the lines of “we will use the cloud in this manner,” and that is why this problem arises. Once the relevant provisions of the Framework Act on Electronic Documents and Transactions are amended from prior reporting to ex post reporting under the Financial Services Commission’s “Improvement Plan for Cloud and Network Separation Regulations in the Financial Sector,” this issue can be regarded as resolved.
2. How should “at least 7 business days before” in the supervisory regulation be interpreted?
In ordinary cases this regulatory requirement is not a problem at all, but when the service launch date falls across a public holiday, or when the service launch schedule is urgent, it can become a considerably serious issue, on the order of a violation of the regulation.
1) The regulatory wording “at least 7 business days before” first requires an understanding of “business day” and of “before.”
“Business day” means a business day excluding Saturday, Sunday, and public holidays, and “before a business day” includes that business day. (If the business day itself is not to be included, the wording would have to be “prior to the business day.”)
2) However,
In practice, whether the supervisory regulation is violated or observed can turn on a difference of a single day, so it is common to treat “at least 7 business days before” as “7 business days prior” and to plan the schedule on that basis.
3. This is a single project, but for practical reasons it is being carried out as two services with two launch dates. Must the usage report be filed in two parts?
The supervisory regulation requires the usage report to be filed “at least 7 business days before,” so thinking can become confined to the launch date, but there are more important considerations than that.
In particular, development methods recently applied at financial companies, such as agile methods and DevOps, launch on a frequent basis, so there is no need to confine thinking about the usage report to the service launch date. It is better to consider whether the entrustment contract with the contractors for development of the service (CSP, MSP, and Master MSP) is a single contract or is divided, and whether the internal operating organization is divided. This may differ according to the company’s internal policy, but, taking into account the operational management points mentioned in the supervisory regulation, such as occasional reports and the annual safety and soundness assessment of the CSP and the MSP, filing the usage report as a single project is recommended. If greater certainty is wanted, confirming the approach through sufficient consultation with the examiner in charge during prior consultation with the Financial Supervisory Service is also a sound method. This issue will also be resolved, because under the Electronic Financial Transactions Act scheduled for amendment it will change to ex post reporting.
4. Does the cloud usage report end once the initial usage report is completed properly?
From a financial company’s standpoint, while attention is concentrated on the project under way, it is easy to think that the cloud usage report can be forgotten once it is filed at the time of implementation. This usage report, however, requires under the supervisory regulation that documents be kept current and that occasional reports be made, so it is advisable to prepare in advance for the Financial Supervisory Service’s comprehensive audit by securing evidence of activity at least once a year even after implementation. There is work a financial company must do across every stage, from the start of using the cloud service through operational management and through suspension or termination of use.
Therefore, it is prudent to define the scope carefully from the prior consultation or usage-report stage and to take the operational stage (occasional reports, keeping documents current, and so on) into account as well.
5. Which department is the appropriate one to file the cloud usage report?
This can differ according to the R&R among the financial company’s internal organizations, or according to the enterprise-wide strategy and characteristics of its organizational structure, but it can become an issue at a financial company filing a usage report for the first time. The first criterion to consider is that the responsible department should be selected by referring to internal regulations on the roles and responsibilities for operating the service at the enterprise level. It is also necessary to consider which organization can first detect a material change in cloud use, as specified in the supervisory regulation. For now, most companies assign the usage report to the information security department, but assigning it to the organization responsible for service operations would allow a faster response to related issues.
6. The main points of the “Improvement Plan for Cloud and Network Separation Regulations in the Financial Sector,” which is currently at the stage of collecting opinions, are as follows.
Once the improvement plan below is finalized, amendments to the related regulations and the Electronic Transactions Act are expected to prevent, to some degree, the confusion that currently surrounds cloud use. (https://www.fsc.go.kr/no010101/77672?srchCtgry=&curPage=&srchKey=&srchText=&srchBeginDt=&srchEndDt=)
- Unclear criteria for assessing the importance of work
→ Prepare specific criteria and procedures for assessing the importance of work - Overlapping and similar CSP assessment items
→ Rationalize overlapping and similar assessment items (reduced from 14 control areas and 141 assessment items to 11 control areas and 54 assessment items) - Non-critical work must also comply with nearly all usage regulations that apply to critical work
→ Differentiate cloud usage procedures between critical and non-critical work (mandatory items and alternative items) - Each financial company and similar entity performs its own CSP assessment
→ Introduce a representative assessment system by the Financial Security Institute - Difficulty with CSP assessment in the case of SaaS
→ Define exception items suitable for SaaS - Overlap among documents submitted when using the cloud
→ Simplify submission, including overlapping items such as “supplementary matters for the operational standards on business entrustment” - Prior report to the financial authorities (7 business days before)
→ Ex post report to the financial authorities (within 3 months) - Ease the uniform, one-size-fits-all physical network separation regulation
→ Network separation exception for research and development fields that do not involve personal (credit) information (limited to cases in which a self-assessment of risk is conducted and information protection controls that substitute for network separation are then applied)
→ Pursue a network separation exception for non-electronic financial business and for SaaS (regulatory sandbox)
→ (Mid to long term) Pursue a phased easing of network separation
* Inquiries about business and related matters: T) 02-322-4688, F) 02-322-4646, E) info@wikisecurity.net