The revised cloud security certification rating system, which aims to implement a digital platform government, revitalize private cloud computing, and strengthen the competitiveness of the domestic cloud industry, has been announced and is nearing completion of its final revision.

The Ministry of Science and ICT (MSIT) announced that it will conduct an administrative notice from December 29 to January 18 on the revised 'Notice on Cloud Computing Service Security Certification' to introduce a cloud security certification grading system.

To revitalize the overall cloud market by opening up the public sector, where private cloud use was previously restricted, and to innovate public services, the previously uniform security certification system will be improved and a high, medium, and low-grade system will be introduced.

The Ministry of Science and ICT announced that cloud security certification for lower-level systems will be implemented after the announcement of the notice, and for upper- and middle-level systems, the detailed evaluation criteria will be supplemented through joint verification and validation by the Digital Platform Government Committee and relevant ministries, taking into account safety and usability, and will be implemented within 2023.

Governments and public institutions that wish to use private clouds classify their systems into high, medium, and low levels according to the system importance classification criteria and procedures. The lower grade will be classified as a system that operates public data that does not include personal information, the middle grade as a system that includes or operates non-public business data, and the upper grade as a system that includes sensitive information or operates internal administrative work.

However, in order to create new cloud markets and improve the quality of public services, the administrative internal work operation system can be classified as mid-level according to system importance.

Cloud service security certification evaluation criteria are also expected to be differentiated. The Ministry of Science and ICT will differentiate the security certification evaluation criteria for cloud service providers by grade. Based on existing evaluation criteria, the criteria for higher grades will be supplemented and strengthened, while the criteria for mid-grades will remain at their current level. The criteria for lower grades will be reasonably relaxed.

Specifically, for lower-tier systems, the existing "physical separation" requirement between the private and public sectors will be relaxed to allow "logical separation," allowing domestic software-as-a-service (SaaS) providers to enter the public market. However, evaluation items will be added to verify the requirement that cloud systems and data be physically located within Korea.

The mid-level system will also be able to classify administrative internal work operation systems into mid-level systems based on their importance, and will allow network access with guaranteed security, and plan to supplement detailed evaluation criteria through verification and validation of internal and external network access and utilization. In addition, for existing types (IaaS, SaaS Standard, SaaS Easy), unnecessary evaluation items such as reward and penalty provisions were integrated and deleted to reflect industry concerns, and regulations were rationally simplified by relaxing the criteria for table separation by user organization in consideration of the characteristics of cloud multi-tenant (multi-user use).

During the administrative notice period, the Ministry of Science and ICT will gather input from various sectors through forums involving industry, relevant organizations, and others. The results of these discussions will be reflected in the final revised public notice, which will be published in January. The full text of the revised notice is available on the Ministry of Science and ICT website.

An official from the Ministry of Science and ICT said, “In order to successfully implement a digital platform government, both innovation in public services utilizing private cloud services and strengthening the competitiveness of the domestic cloud industry must be considered together.” He added, “For lower-tier systems, we will consider creating an international competitive environment and security aspects, and for upper- and middle-tier systems, we will create new markets and strive to grow the domestic cloud industry as a whole.”