(Norm 9) States should take reasonable steps to ensure the integrity of the supply chain so that end users can have confidence in the security of ICT products. States should seek to prevent the proliferation of malicious ICT tools and techniques and the use of harmful hidden functions; ㆍPromoting 5G security The ROK established the 5G Mobile Communication Industry Development Strategy in 2016, envisioning a leading nation in the 5G network communications. In the same context, considering the fact that the 5G security needs to be addressed for garnering its socioeconomic benefits, the ROK formed a 5G security technological advisory council with security experts in 2018 to help telecom firms to carry out security monitoring more effectively and support the security technologies. ㆍLaunch of the Internet of Things (IoT) authentication service With the expansion of IoT devices connecting people’s daily lives, the security vulnerabilities have also increased. To address the issue, the ROK has managed the IoT security authentication service since 2017. The authentication is processed on a rolling basis, so tech firms, telecom companies, and other private actors can get an authentication for its IoT devices or synced mobile applications. (Norm 10) States should encourage responsible reporting of ICT vulnerabilities and share associated information on available remedies to such vulnerabilities to limit and possibly eliminate potential threats to ICTs and ICT-dependent infrastructure; In accordance with the National Cyber Security Management Regulation, the NCSC operates cyber threats response system by which relevant information is shared in real time, threat warnings and response guidelines are issued accordingly. Weekly cyber threats index is updated and notified to government institutions. Similarly, relevant agencies have their own cybersecurity control centers to detect and promptly respond to cyber threats. The ROK encourages private entities to share information on cyber threats. Since 2012, the KISA has operated bug bounty programs to encourage individuals to report bugs and vulnerabilities in software. Since its implementation, 1,466 bugs and vulnerabilities have been reported. In 2014, the KISA established the Cyber Threats Analysis System (C-TAS) where information on cyber threats can be shared among information security users. A member, accredited by the government, can get an access to the information for free and be bound to share its information. The KrCERT/CC has uploaded major vulnerabilities on its websites on a regular basis in order to share relevant information with other CERTs and international cybersecurity firms. Also, the KrCERT/CC is actively engaging in cooperation with other CERTs by sharing relevant information when necessary. 9 / 10