[Coupang] Training on how to review the privacy policy, focusing on incorrect sections

The shortage of PMs at security consulting firms continues. As a result, many people in their 40s and 50s who have worked in completely unrelated fields are brought in as PMs to handle client communications. Because these PMs have no background in technology, consulting, or security, the work is very challenging. Many join with the mindset of learning from other PMs through a handover, and then continue performing the work. I have also provided training for PMs and handed over work, using the approach outlined below, and satisfaction has been high.

Training for obtaining ISMS-P certification and ISO27001/ISO27701 certification

<Abandon the Existing Personal Information Responsibilities and Pursue Reform: Proposals for Alternatives> This lecture presents opinions on various current issues (related to data breach incidents), including transparently disclosing the processing of personal information by changing the division of responsibilities between the Personal Information Team and personal information officers; forming a TFT organized as one team with developers; providing DFDs that the public can choose from and giving them the right to choose; and promoting simulated hacking and security monitoring under a unified personal information team system to provide administrative support personnel and technical safeguards aligned with the public’s expectations.

The grounds previously used to pursue certifications such as ISMS-P, including penalty reductions, have become even more significant. With the revision of the Enforcement Decree of the Personal Information Protection Act following a series of large-scale personal information breaches involving Coupang, SKT, Lotte Card, and others, an unprecedented system has been introduced that provides a reduction in administrative fines—40% of the 10% of revenue—when a proactive protection system has been established before an incident occurs. Accordingly, a legal basis has now been established through the reduction system for the priority introduction of measures such as inspections of personal information processing systems and the securing of dedicated personal information protection personnel, which had previously been difficult to manage and inspect under the existing Personal Information Protection Act. Therefore, additional items must be reflected in the personal information protection regulations, additional records of personal information protection activities must be prepared, and the time has come to review budgets, including records of the implementation of personal information protection solutions. These measures, scheduled to take effect from the second half of 2026, must be reflected in the personal information management system without delay so that reporting to the CPO can be carried out.

This training explores the service privacy reviews pursued by Naver, Kakao, and Toss. It is designed to improve the capabilities of domestic consulting and privacy protection teams by identifying where service-specific privacy protection should be applied and explaining what to check during service reviews. Rather than covering only general laws or standard review checklists, this is an in-depth review training program that also provides a checklist.

The purpose is to improve, compared with last year, awareness campaigns that are not defined in the regulations and often end merely with the distribution of promotional gifts, by referring to best practices from various organizations, given the current situation in which the performance of events and campaigns such as Information Security Day or Personal Information Protection Day, held monthly or annually, is gradually declining. These events must now move beyond gift-distribution activities organized by the Information Security Team and become events in which all employees participate and uphold security together. It is necessary to build mutual understanding through the establishment of a communication system for embedding security into the organization. Ultimately, employees must have a good understanding of information security and the Personal Information Protection Act so that the organization can realistically protect itself from hacking and insider threats. Since the departments other than the Security Team—including those responsible for commissioning various projects, managing entrusted service providers, controlling applications and security settings, planning various informatization projects, and conducting IT audits—are designated to take overall responsibility, the Security Team is distributing security-related tasks among the respective departments. However, the current situation is that each department is merely expressing dissatisfaction. This opportunity should therefore be used to move away from that situation, as internal consultative bodies alone are insufficient. Security-related scoring criteria must be reflected in the powerful personnel evaluation system. Through unannounced audits, those who fail to comply should be disciplined through pay reductions or suspension, while those who properly observe security requirements and demonstrate achievements in support of security should receive substantial financial rewards through an incentive system. Security must be embedded in the organization so that employees take the initiative themselves. Accordingly, department and individual evaluation KPIs should be adjusted through a report to the CEO under the direction of the CISO. In addition, through a system for designating department-level information security officers and personnel in charge, the organization should strengthen its human security framework against hacking and information leakage—including the leakage of documents managed by each department and the management of service providers—by providing position allowances for these responsibilities.

Massive personal data breaches affecting citizens due to repeated hacking incidents of the same type at card companies and insurance companies Other personal information controllers also continue to experience repeated incidents because they fail to prevent the same causes and the same attack methods Detection is impossible, yet budgets are spent on upgrading security monitoring and more personnel continue to be hired, while reporting systems and internal regulations remain inadequate Customer complaints and inconvenience persist due to incomprehensible management systems, and service trust has fallen to zero' This is part of a lecture for ongoing research and guidance aimed at addressing these issues.

As incidents involving the leakage of linkage information have occurred and come to light, measures such as assessing the importance of CI information and how it is managed have been implemented. Accordingly, specialized training is provided.

Following the Personal Information Audit 1 training, internal privacy officers have made insufficient progress in improving their work. They continue to perform their duties as they did last year, resulting in ongoing failures to prevent and stop incidents in advance due to negligence. Executives—including the CEO, CPO, division heads, and department heads—have insufficient understanding of personal information protection. As a result, the Privacy Protection Team has not provided adequate in-house training or communication on key points. As the department responsible for personal information, the Privacy Team continues to rely solely on checklists for accurate legal assessments and inspections. Checklists based only on the minimum requirements under the law leave many blind spots, and this issue needs to be addressed. Training on accurate and authoritative knowledge is needed, as inspections must be based on precise case law and enforcement actions.

Establish a reporting system for pursuing various agenda items through bodies such as the Privacy Protection Policy Council and Working-Level Council, and for reporting to executives (the CEO) on the Chief Privacy Officer’s (CPO’s) review of compliance with security measures and legal obligations. An internal privacy audit system needs to be established and implemented to conduct expert preliminary investigations and inspections into recent hacking and data breach incidents. Recognize that existing certification frameworks, such as ISMS-P, cannot prevent incidents. Despite the need to develop audit checklists that reflect the diverse characteristics of services and industries, and to carry out wide-ranging tasks—including reviewing internal personal information files and business processes (through flow analysis) at more than 1,000 partner companies and over 100 branches—these tasks are not being pursued. Although diverse blind spots must be addressed, experts lack the necessary knowledge to defend against them. Appropriate audits of existing security systems are not being conducted. Moreover, those regarded as experts in management systems are in fact not experts, resulting in recurring incidents and persistent risks. This study will address blind spots and strengthen reviews of existing security systems through detailed inspections, identify areas for improvement, and report the findings.

Training on practical inspection methods, including on-site verification, tailored to the nature of audits, with relevant 2026 case studies to consult when conducting on-site audits and other security audit activities for the Information Security Division. The training will also enable improvements following a review of existing work processes.

In Financial AI Security (PART1. Basics), I provided an overview of AI security. This is practical training for professionals on the AI checks required during security reviews for actual penetration testers (Red TEAM), so please keep it in mind. This course covers practical material and explains how to conduct penetration tests from a technical perspective. (It includes a checklist.) When studying, you may find AI challenging. Also, because AI guidelines are based on modeling standards, conducting reviews can be difficult, and many companies have not implemented them. I expect that you may have received various audit feedback regarding the establishment of AI security governance. The reason is clear: there is no solid evidence of AI security in your internal operations. Now is the time to establish it. I hope you’ll study AI security and pursue a career as an AI security professional.

At last, I’ve gained a clear, practical understanding of the AI security review (NIS/FSI) checklists that had been somewhat ambiguously established over the past 7–8 years, and I’ve mapped out how to revise, establish, and operate the relevant management system. I’ll explain what AI security is and how it should be improved from June 2026 onward, based on the standards of Korea’s leading companies—the highest level of information security in the country. (This is not a basic introduction or conceptual overview.*) The training has been divided into PART1 (Basics_Overview) and PART2 (Advanced_Security Review), so please take a look.

This training was developed to help privacy officers first become familiar with and understand the relevant requirements, so that each company can review its current situation, identify areas for improvement, and establish an improvement plan as part of building a proactive protection framework going forward, as announced in advance through the June 2026 Personal Information Protection Act and PIPC compliance inspections. It draws on more than eight years of experience advising and consulting on the protection of personal credit information, and is intended to support strategy development and the preparation of reports for executive management.

All public institutions for which we provided consulting on personal information protection level assessments over the course of six years achieved the highest rating. These included a wide range of public institutions—from central government agencies to public corporations, small public institutions, and local governments—and all maintained the highest rating through ongoing consulting with the same organizations. We also have a track record of achieving 100 points (ranked No. 1 nationwide). Based on the 2026 guidelines, we can effectively allocate the work and performance evidence needed to prepare quantitative and qualitative reports in light of the strengthened penalties following the Coupang incident and the revised indicators. Depending on each company’s circumstances, even overinvestment or a strategically passive response can be sufficient to qualify as an outstanding case.

Insufficient theoretical knowledge and expertise among management system auditors, resulting in inadequate capacity to assess emerging technologies (cloud management systems) Training to strengthen the expertise of personnel who identify gaps in management systems and prevent incidents in advance to protect companies from hacking Training to help existing infrastructure and penetration testing staff transition into management system roles Providing supporting data to ensure robust capabilities and resources!

If they have experience inspecting only major information and communications infrastructure facilities and lack experience with electronic financial infrastructure, or have experience with servers, databases, networks, and security equipment but lack infrastructure PL or PM experience, leaving them without a broad understanding of infrastructure projects, they need to develop the capability to assess network infrastructure inspection items and be provided with inspection reference data.

As PaaS in public and private cloud environments (previously categorized as WEB/WAS) is brought under in-house PaaS operations, security requirements for financial companies are being expanded and strengthened. These include certification requirements such as ISMS-P, covering cloud asset identification and classification, criticality assessment, and incorporation into risk assessments. The 2026 security standards for financial companies, used in vulnerability analysis and assessment of electronic financial infrastructure, introduce and strengthen inspection items for containers and private cloud management systems. Virtualization and cloud-related items are also being introduced and revised for major information and communications infrastructure. Training for infrastructure project leads overseeing approximately 10 infrastructure inspection staff, and for personnel responsible for vulnerability inspections.

Lack of supporting data for private cloud assessments!! Very few professionals have experience with IaaS assessments!! Providing supporting data to enhance practical work skills and support other certifications and assessments, including Major Information and Communications Infrastructure, Financial Vulnerability Assessment, ISMS-P, and ISO 27001 Specialized training for infrastructure project leaders overseeing around 10 infrastructure assessment staff Providing an understanding of the technical aspects of cloud management systems, along with assessment data!

Provide insights and materials to Project Leaders overseeing financial companies’ simulated hacking/penetration testing, to support their overall management of mock hackers (WEB, Mobile, HTS). There have been repeated cases of teams submitting blank reports when no vulnerabilities are found in their respective areas (the same issue occurs in the public sector). Therefore, require teams to produce inspection results for each checklist item alongside training materials. Conduct checks tailored to each theme and use the results for security reviews and internal security review deliberations.