Financial Cloud Guide A to Z Part 1 – First Steps in Cloud Adoption Explained Through the Electronic Financial Supervisory Regulation

For financial companies to adopt cloud, regulation comes before technology. The relevant materials are scattered across multiple bodies—the Electronic Financial Transactions Act, the Electronic Financial Supervisory Regulation, its enforcement rules, and the Financial Security Institute guide—and this article connects that flow into one.

The regulation consists of a 6-layer structure, with the practical core being Article 14-2 of the Electronic Financial Supervisory Regulation and the Financial Sector Cloud Use Guide. The commentary handles 'legal interpretation,' the usage guide handles 'procedural implementation,' and the reference materials handle 'technical implementation such as AWS.'

Cloud adoption follows these 7 steps:

• ① Selecting the business function and assessing its importance (classified as important/non-important)
• ② Evaluating CSP soundness and safety
• ③ Establishing a business continuity plan and safety assurance measures
• ④ Deliberation and resolution by the Information Security Committee (chaired by the CISO)
• ⑤ Signing a contract with the CSP
• ⑥ Post-hoc reporting to the Financial Supervisory Service within 3 months of service commencement
• ⑦ Implementing an exit strategy when the service ends

When classified as an important business function, stricter safety assurance measures are required, including CSP evaluation items (mandatory + alternative), network segregation, encryption, access control, and disaster recovery. For non-important business functions, some items are applied with relaxed standards.

Regarding network segregation, the obligation for physical network segregation is limited to internal networks, and it can be replaced with logical network segregation in cloud environments. Additional regulations such as the Personal Information Protection Act and the Credit Information Act will be covered in Part 2.