(Unofficial Translation) No. 136 Chapter 69 Kor Government Gazette 27 May 2019 The expert in paragraph one shall have appropriate qualifications or experience in accordance with the notification prescribed by the Committee. The Secretary-General shall issue an expert identification card to the appointed person. When performing duties, such person shall display the identification card as an expert and, once duties are completed, shall return the identification card to the Office without delay. Part 3 Critical Information Infrastructure Section 48 The Critical Information Infrastructure is an operation which are important to national security, military security, economic security, and public order in the country, and it shall be the duty of the Office to assist and provide assistance to prevent, cope with, and mitigate risks from Cyber Threats, especially, Cyber Threats that affect or occur in relation to the Critical Information Infrastructure. Section 49 The Committee shall have the power to prescribe in a notification the characteristics of the organizations that have a mission or provide services in the following aspects, as an Organization of Critical Information Infrastructure: (1) national security; (2) substantive public service; (3) banking and finance; (4) information technology and telecommunications; (5) transportation and logistics; (6) energy and public utilities; (7) public health; (8) others as prescribed by the Committee. The consideration for the prescription of such mission or services under paragraph one shall be in accordance with the rules prescribed by the Committee, which shall be published in the Government Gazette. The Committee shall consider and review such prescription of the mission or services on a case-by-case basis as appropriate. Section 50 The Committee has the power to prescribe the characteristics, duties, and responsibilities of the coordinating agency for maintaining the security of computer systems for the Organization of Critical Information Infrastructure of section 49 to coordinate, monitor, cope with, and resolve Cyber Threats by prescribing the Government Agency that is ready or such Critical Information Infrastructure Supervising or Regulating Organization to perform such duties for the Organization of Critical Information Infrastructure in accordance with section 49, in whole or in part. Consideration for the prescription of such mission or services under paragraph one shall be in accordance with the rules prescribed by the Committee, which shall be published in the Government Gazette. The Committee shall consider and review such prescription of the mission or services on a case-by-case basis as appropriate. Section 51 In the event of any inquiries or claims related to the characteristics of the organizations having the mission or providing the services as prescribed in accordance with section 49 or section 50, the Committee shall make the final decision. Section 52 For the benefit of coordination, the Organization of Critical Information 14

Select target paragraph3