(1) Any financial company or electronic financial business entity shall appoint a chief information security officer to be responsible for managing electronic financial business and information technology security which forms the basis of electronic financial business. <Amended on May 22, 2013>
(2) A financial company or an electronic financial business entity prescribed by Presidential Decree in consideration of its total assets, number of employees, etc. shall appoint one of the executives (including any person prescribed in Article 401-2 (1) 3 of the Commercial Act) as a chief information security officer. <Amended on May 22, 2013>
(3) The chief information security officer of the financial companies or electronic financial business entities prescribed by Presidential Decree in consideration of its total assets, number of employees, etc. shall not concurrently perform duties in the information technology sector other than those referred to in paragraph (4). <Added on Oct. 15, 2014>
(4) A chief information security officer under paragraph (1) shall perform the following duties: <Amended on Oct. 15, 2014>
1. Establishing strategies and plans for securing the stability of electronic financial transactions under Article 21 (2) and protecting the users thereof;
2. Protecting the information technology sector;
3. Managing human resources and forming a budget, which are necessary for the security of the information technology sector;
4. Preventing electronic financial transaction accidents, and taking measures therefor;
5. Other matters prescribed by Presidential Decree for securing the stability of electronic financial transactions.
(5) Matters necessary for qualifications, etc. for a chief information security officer shall be prescribed by Presidential Decree. <Amended on Oct. 15, 2014>[This Article Added on Nov. 14, 2011]