(Unofficial Translation) No. 136 Chapter 69 Kor Government Gazette 27 May 2019 prevent, cope with, assess, suppress, and suspend the Cyber Threats at each level to present to the Committee; (7) analyze the situation and evaluate the effect from Cyber Threats, in order to propose to the Committee to consider issuing an order, in the case there is or may be an occurrence of a Cyber Threat in a level that is more critical. In determining the standard framework according to paragraph one (4), the risk management principals shall be considered, which shall contain at least the approaches and measures as follows; (1) specification of the risk that may occur to the computer, computer data, computer system, other information related to computer system, property, and life and body of a person; (2) measures to prevent the risk that may occur; (3) measures to examine and monitor the Cyber Threats; (4) measures to respond when the Cyber Threats are detected; (5) measures to remedy and restore the damage occurred from a Cyber Threat. Section 14 In order to act in accordance with section 13 paragraph one (2) to cope with Cyber Threats in a timely manner, the CRC may assign the Minister of the Digital Economy and Society, Supreme Commander, and other directors as determined by the CRC to jointly perform such duty, and may determine that the Supervising or Regulating Organization and the threatened Organization of Critical Information Infrastructure shall join in order to act, coordinate, and provide support. The performance under paragraph one shall be in accordance with the rules prescribed by the CRC. Section 15 The provision of section 6, section 7, and section 8 shall be applied to the honorary directors in the CRC mutatis mutandis. Section 16 The CRC shall have the power to appoint the sub-committee to perform any tasks as assigned by the CRC. Section 17 The meeting of the CRC and the sub-committee shall be in accordance with the rules as determined by the CRC, where the meeting may proceed via electronic means or other means. Section 18 The chairperson, the chairman of the sub-committee, and the subcommittee which the CRC appointed shall receive a meeting allowance or other compensation in accordance with the criteria determined by the Cabinet. Section 19 In order to perform the duties in accordance with this Act, the Competent Official shall present his/her identification card to the relevant person. In the appointment of the Competent Official, the Minister shall consider appointing a person with the knowledge and expertise in Maintaining Cybersecurity to be the Competent Official to perform any tasks under this Act. The level of such knowledge and expertise of the Competent Official shall be in accordance with the notification prescribed by the CRC. The identification card issued to the Competent Official shall be in accordance with the notification prescribed by the CRC. Chapter 2 6

Select target paragraph3