Amid recurring data breaches at companies with government-certified information security systems, the government has decided to significantly tighten management and auditing processes for those systems.

The Personal Information Protection Commission and the Ministry of Science and ICT on Saturday discussed ways to enhance the oversight of the Information Security Management System, or ISMS, and ISMS-P. 

Under the plan, the ISMS-P, which currently operates on a voluntary basis, will become mandatory for key organizations in the public and private sectors, including telecom companies and large-scale platform operators. 

New, stronger certification criteria will be devised for companies with significant public impact.

In the event of a data leak at a certified company, a special post-incident audit will follow, and companies might lose their certification for serious breaches of compliance with certification requirements.