National Network Security Framework (N2SF): Five-Step Application Process

What is N2SF?

The National Network Security Framework (N2SF) is a security framework designed to help Korean national and public-sector organizations establish security measures based on the importance of business information, information systems, and information services.

Rather than applying exactly the same security measures to every environment, N2SF focuses on identifying information assets, classifying them according to their security importance, identifying threats, and applying appropriate security controls.

The N2SF Security Guidelines 1.0 define five major steps:

1. Prepare

2. Categorize

3. Identify

4. Select

5. Assess

The five-step process is described as a framework for establishing an organization's own security measures for information projects.

1. Prepare

The Prepare phase establishes the foundation for the entire N2SF process.

Organizations identify and analyze:

• Business functions

• Business information

• Information systems

• Networks

• Information services

• Service-use scenarios

• Basic security objectives

The guideline divides this phase into five activities:

• Establish the N2SF implementation plan

• Analyze organizational business functions

• Identify business information

• Identify information systems

• Identify information services

Why is this important?

Security analysis cannot be performed effectively without understanding what the organization actually does, what information it handles, and which systems process that information.

Therefore, N2SF starts with the organization's business and information, rather than starting with network devices or security products.

2. Categorize — C/S/O Classification

The second phase classifies business information and information systems into three security levels:

The business information should be classified first, followed by the information systems that process that information.

The guideline explains that classification should be based on relevant laws and information-disclosure requirements rather than simply relying on subjective judgments.

Information System Classification

After business information is classified, the systems involved in producing, storing, processing, transferring, retaining, or disposing of that information are classified.

When multiple security levels of information are handled by one system, the highest applicable level can determine the system's classification.

The guideline also discusses separating systems by security level where appropriate, particularly because applying unnecessarily high security requirements to lower-level information may reduce information usability.

3. Identify — Threat Identification

The third phase identifies threats within the entire information-service environment.

A key N2SF methodology is Location–Subject–Object modeling.

Location

The physical or logical domain where an information system or user is located.

Subject

An information system that uses or handles business information.

Object

The information system or service accessed by the subject.

Each element is assigned a C/S/O level. This allows the organization to identify situations in which different security levels are mixed within an information-service environment.

4. Apply the Information Production/Storage Principle

N2SF considers it a potential security concern when information with a higher security level is produced or stored in an information system with a lower security level.

For example, handling Sensitive-level business information through an Open-level external service may require additional security controls.

The guideline uses a generative-AI workplace environment as an example of this type of analysis.

5. Apply the Information Transfer Principle

Another important principle concerns information movement.

When business information moves to an information system with a lower security level, the transfer becomes a potential threat that should be analyzed.

For example, if Sensitive-level information can be uploaded from an internal work device to an Open-level external generative-AI service, the organization should examine controls such as upload restrictions and filtering at the connection point.

6. Consider Additional Threats

N2SF's basic modeling methodology focuses on structural threats associated with different security levels.

However, organizations may also need to consider:

• Vulnerabilities

• Malware

• Denial-of-Service attacks

• Supply-chain threats

• Insider threats

• Account compromise

• Security misconfiguration

• Data leakage

The guideline notes that additional methods such as vulnerability assessments, penetration testing, threat-modeling tools, and cyber threat intelligence may be considered for broader threat identification.

Risk assessment can also be used to consider likelihood and impact when prioritizing security measures.

7. Select — Establish Security Measures

Once threats have been identified, the organization determines how to address them.

The Select phase consists primarily of:

1. Deriving security requirements

2. Selecting security controls

Security requirements should be derived from the identified threats and should also incorporate the basic security objectives established during the Prepare phase.

Security controls are then selected as practical administrative, physical, or technical measures for satisfying those requirements.

8. Develop the Security Control Implementation Plan

Selecting a security control is not the end of the process.

An implementation plan should define:

• How the control will be implemented

• Technical requirements

• Implementation schedule

• Priority

• Responsible personnel

• Required resources

• Budget and technology considerations

N2SF allows organizations to adjust or add controls when the standard controls do not fully address the characteristics of a particular information service.

9. Assess — Evaluate and Adjust

The final phase reviews the entire N2SF process.

The organization evaluates whether the activities performed during:

Prepare → Categorize → Identify → Select

were appropriate and sufficiently complete.

The Assess phase consists of:

• Appropriateness assessment

• Consultation and adjustment

• Final confirmation

10. Rework When Problems Are Found

N2SF is not necessarily a strictly one-directional process.

If an assessment identifies a problem, the relevant previous activity and affected subsequent activities can be performed again.

For example, if an information system's C/S/O classification changes, the threat analysis and security-control selection affected by that classification may also need to be reviewed.

This feedback mechanism is important because changes in one stage can affect the results of subsequent stages.

11. Final Security Review

After all five N2SF phases have been completed and the results have been assessed and adjusted, the organization prepares the final documentation.

The guideline explains that the results of the entire N2SF process are consolidated into a final security-measures document, which can be used for the National Intelligence Service security review process.

The overall workflow can therefore be summarized as:

Business analysis

↓

Business information identification

↓

Information system and information service identification

↓

C/S/O classification

↓

Location–Subject–Object modeling

↓

Threat identification

↓

Security requirements

↓

Security control selection

↓

Implementation planning

↓

Assessment and adjustment

↓

Final documentation

↓

Security review

12. Practical Considerations for N2SF Implementation

Start with business, not the network

N2SF should not be understood simply as another network-segmentation technology.

The process begins by understanding organizational functions and business information, then connects those findings to information systems and information services.

Classify information before selecting controls

Not every piece of information requires the same level of protection.

C/S/O classification provides a basis for determining the appropriate level of security measures and connecting information classification with system and service security architecture.

Analyze information flows when using AI and cloud services

N2SF is particularly relevant to environments involving:

• Cloud services

• SaaS

• Generative AI

• Remote work

• Mobile work environments

• External information services

The important question is not simply whether a particular technology is "allowed" or "prohibited."

Instead, organizations need to understand:

Where is information created?

Where is it stored?

Where is it processed?

Where does it move?

What security level exists at each point?

The N2SF guideline itself uses generative AI as an example when explaining threat identification.

13. N2SF Five-Step Checklist

This five-stage structure represents the core workflow described in the N2SF guideline.

14. Conclusion

The National Network Security Framework (N2SF) provides a structured approach for designing security measures based on business functions, information importance, information-service architecture, and identified threats.

Its core concept can be summarized as:

Understand the business → identify information → classify information and systems → model information services → identify threats → define security requirements → select controls → assess and adjust.

This approach is particularly relevant as public-sector organizations increasingly adopt cloud computing, generative AI, SaaS, remote work, and other emerging technologies.

Rather than applying identical security measures everywhere, N2SF provides a process for determining what needs to be protected, what threats exist, and what controls are appropriate for each environment.

In short:

Prepare → Categorize → Identify → Select → Assess

These five stages form the basic process for applying N2SF to an information-service environment.