Understanding the Core Concepts of N2SF

Moving from Network Segmentation to Risk-Based Security

The National Network Security Framework (N2SF) is becoming an important concept in the information-security environment of Korea's public sector.

Rather than relying solely on physical or logical separation between internal and external networks, N2SF focuses on identifying business information and information systems, assessing their importance and potential threats, and applying security controls appropriate to the identified risks.

The N2SF Security Guideline 1.0 published in September 2025 provides not only the framework's basic concepts and principles but also a five-step implementation process and guidance for selecting security controls.

1. What is N2SF?

N2SF is a security framework designed for national and public organizations.

Its basic approach is to:

1. Identify business information and information systems.

2. Classify them according to their importance.

3. Identify threats within the information-service environment.

4. Select appropriate security controls.

5. Assess and adjust the resulting security measures.

The framework uses three security classifications:

• C — Classified

• S — Sensitive

• O — Open

The key idea is that security controls do not necessarily have to be identical for every system. Instead, they can be differentiated according to the importance of the information and the threats associated with the service environment.

2. Why was N2SF introduced?

Network separation has played an important role in Korea's public-sector security policy for many years.

Separating internal business networks from Internet-facing networks helped reduce the risk of unauthorized access and information leakage from external cyber threats.

However, the IT environment has changed significantly.

Organizations increasingly need to use:

• Cloud computing

• Generative AI

• Remote work

• Public data

• Digital collaboration

• Integrated public-private services

The N2SF guideline describes these changes as an important background for developing a more flexible security policy while maintaining security.

Therefore, N2SF can be understood as an attempt to move toward security controls based on information importance and actual risk rather than relying only on network separation.

3. Core Concept #1: Business → Information → System → Service

One of the most important concepts in N2SF is the relationship between organizational functions and information systems.

The framework recommends connecting organizational activities with functional classification systems and then identifying the information and systems associated with those activities.

The relationship can be summarized as:

Functional Classification
→ Organizational Business
→ Business Information
→ Information System
→ Information Service

This approach makes it possible to understand where information is created, stored, processed, transferred, retained, and eventually disposed of.

This means that N2SF does not look at a server or network device in isolation.

Instead, it asks:

What business function does this system support?

What information does it handle?

Which other systems interact with it?

This provides the foundation for risk-based security decisions.

4. Core Concept #2: C/S/O Classification

C/S/O classification is one of the most recognizable features of N2SF.

C — Classified

This category includes highly sensitive information associated with areas such as national security, defense, diplomacy, investigations, and information directly related to people's life or safety.

S — Sensitive

This category covers information whose disclosure could potentially harm individual or national interests.

The guideline also includes certain system logs and temporary backups within the broader concept of sensitive information.

O — Open

Open information generally refers to information that does not fall into the Classified or Sensitive categories, including information that can legally be disclosed.

An important point is that the classification of information is connected to the classification of the systems processing that information.

If a system handles information with different classifications, the highest classification may determine the system's classification. The guideline also recommends considering separate operation of systems with different classifications to avoid imposing unnecessarily high security requirements on lower-classification information.

5. Core Concept #3: Classifying Locations

N2SF also considers the physical and logical location of information systems.

The guideline provides examples such as:

• Internet domain → O

• Business domain → S

• Specialized environments handling classified information → C

Location classification becomes a foundation for later threat identification and security-control decisions.

This means that the framework asks more than:

"Is this server secure?"

It also asks:

"Where is the information processed?"

"Who uses it?"

"What systems does it connect to?"

6. Core Concept #4: Location–Subject–Object Threat Modeling

N2SF uses threat modeling to identify structural security threats before selecting security controls.

The guideline simplifies an information-service environment into three major elements:

Location / Domain

The physical or logical area where a system is located.

Subject

An information system that uses business information.

Object

The target information system accessed or used by the subject.

Each element can be assigned a C/S/O classification.

This makes it easier to identify situations where different security classifications are connected.

For example:

S Location → S Subject → O Object

may require additional security controls around the subject, object, and connection between them.

7. Core Concept #5: Information Production, Storage and Movement

N2SF provides two important security principles for analyzing information flows.

Information Production and Storage Principle

In general, an information system can produce or store information with the same or lower security classification.

If information outside this range is handled, additional security measures should be considered.

Information Movement Principle

In general, information can move to an information system with the same or higher security classification.

If information moves outside this principle, additional security controls are required.

These principles demonstrate that N2SF is concerned not only with network architecture but also with how information itself is created, stored, processed, and transferred.

8. Core Concept #6: Security Controls Based on Identified Threats

N2SF follows a basic logic:

Identify the threat

↓

Determine the security requirement

↓

Select the appropriate security control

The guideline organizes security controls into major categories including:

1. Authorization

2. Authentication

3. Separation and Isolation

4. Control

5. Data

6. Information Assets

Each control has an identifier and priority considerations based on C/S/O classifications.

This makes N2SF different from an approach in which every organization simply deploys the same security products.

Instead, the organization first identifies the risk and then determines which controls are necessary.

9. The Five-Step N2SF Process

N2SF consists of five major steps.

1. Prepare

Identify organizational functions, business information, information systems, and information services.

2. Categorize

Classify business information and information systems using C/S/O levels.

3. Identify

Model the information service and identify potential security threats.

4. Select

Derive security requirements and select appropriate security controls.

5. Assess

Evaluate the previous steps and make adjustments where necessary.

The process can therefore be remembered as:

Prepare → Categorize → Identify → Select → Assess

The guideline presents this five-step process as the basic procedure for establishing an organization's own security measures for information services.

10. Organizational Autonomy and Responsibility

Another important feature of N2SF is the concept of organizational self-security.

Each organization is expected to analyze its own business functions and information-service environment, identify threats, and design appropriate security measures.

The guideline also allows organizations to consider not only technical conditions but also non-technical factors such as regulations, budgets, and available personnel.

Therefore, N2SF should not be viewed simply as a new network architecture or security-product deployment project.

It represents a broader change in the way organizations make security decisions.

11. N2SF in the Era of AI and Cloud Computing

The importance of N2SF is closely connected to the increasing use of AI and cloud technologies.

The guideline explicitly describes N2SF as a framework that can support public organizations in adopting emerging technologies such as AI and cloud computing while establishing appropriate security measures.

Consider the example of using generative AI for government work.

Instead of asking only:

"Can we use this AI service?"

an N2SF-oriented analysis can ask:

• What information will be sent to the AI?

• What is its C/S/O classification?

• Where is the AI service located?

• Who can access it?

• Which systems are connected?

• Is information stored?

• Does information leave the organization?

• What security controls are necessary?

This type of analysis is particularly relevant to modern environments involving generative AI, cloud platforms, and remote work.

12. N2SF vs. Traditional Network Separation

The difference can be summarized as follows:

N2SF is therefore better understood not simply as "removing network separation," but as expanding the security perspective from network-centric protection to business-, information-, and risk-centric protection.

13. Why N2SF Matters

The fundamental objective of N2SF is to balance security and operational usability.

Public organizations need strong security to protect national functions and public services.

At the same time, they need to use AI, cloud computing, and data effectively.

N2SF provides a structured process:

Understand the business

→ Identify information

→ Classify importance

→ Model the information service

→ Identify threats

→ Apply appropriate controls

→ Assess and adjust

The result is a security approach that begins with what needs to be protected and what risks exist, rather than focusing only on where a system is located.

14. N2SF in 2026

N2SF has also moved toward practical implementation in the public sector.

In June 2026, the Korea Internet & Security Agency (KISA) announced the selection of six consortiums consisting of national/public organizations and security companies for its 2026 N2SF adoption-support program. KISA described N2SF as a framework that classifies business information into Classified, Sensitive, and Open levels and applies differentiated security levels according to those classifications.

This indicates that N2SF is developing beyond a policy and guideline concept toward practical adoption in public-sector information services.

15. Six Keywords to Remember

If you want to understand N2SF quickly, remember these six concepts:

1. Business-Centric Security

Start with organizational functions and business processes.

2. Information-Centric Security

Identify the information produced, processed, stored and transferred by those processes.

3. C/S/O Classification

Classify information as Classified, Sensitive or Open.

4. Threat Modeling

Analyze information services using the Location–Subject–Object model.

5. Risk-Based Controls

Select security controls according to identified threats and requirements.

6. Continuous Assessment

Evaluate the results and adjust security measures when necessary.

In short, N2SF represents a shift from asking "How should networks be separated?" to asking "What must be protected, what threats exist, and which security controls are appropriate?"

One-Sentence Summary

N2SF is a risk-based security framework that classifies business information into C/S/O levels, identifies threats across information services, and applies appropriate security controls to balance security and operational flexibility.

Keywords

National Network Security Framework, N2SF, Network Segmentation, C/S/O Classification, Threat Modeling