What Is N2SF?

A Practical Guide to Information Classification and Security Controls for Korean Public-Sector IT Officials

One of the important changes in Korea's public-sector cybersecurity environment in 2026 is the formalization of the National Network Security Framework (N2SF).

The revised National Cybersecurity Basic Guidelines, dated May 1, 2026, newly established Chapter 3, Section 1, titled National Network Security Framework (N2SF). The section covers four major areas: identification of information classifications, processing of business information, placement of information systems, and security controls.
The Korea Internet & Security Agency (KISA) describes N2SF as a framework that classifies public-sector business information into Classified, Sensitive, and Open levels according to importance and applies differentiated security levels accordingly.

This article explains N2SF in practical terms for public-sector IT and information-system managers.

1. Why Is N2SF Needed?

Korean public institutions have traditionally relied heavily on network separation as an important security measure.

Network separation can reduce certain security risks, but public-sector organizations are increasingly using:

Cloud computing
Generative AI
SaaS
External data services
Inter-agency data exchange
APIs
Digital collaboration platforms

As these technologies become more common, cybersecurity cannot be determined solely by asking whether a network is physically or logically separated.

Instead, organizations increasingly need to ask:

What information is being processed? How important is it? Where is it processed? What threats exist? What security controls are required?

This is the basic perspective of N2SF.

The N2SF security guideline describes the framework as a system for identifying business information and information systems, classifying them as Classified (C), Sensitive (S), or Open (O), and applying differentiated security controls.

2. The Basic Structure of N2SF

A simple way to understand N2SF is:

Organizational Functions → Business Information → Information Systems → Domains → Security Controls

For example, a public institution may operate:

Public services
Internal administration
Human resources
Public websites
Policy-related systems
Data management systems

Each function generates or uses different types of business information.

Those information assets are then processed by applications, databases, servers, cloud systems, and other information systems.

Therefore, N2SF starts with understanding business functions and information, rather than simply starting with network equipment.

3. The First Key Principle: Classify Business Information

Article 39-2 of the National Cybersecurity Basic Guidelines requires each institution to identify and classify its business functions and classify the business information handled by those functions into:

Classified
Sensitive
Open

The Guidelines also require business functions to be subdivided sufficiently to clearly distinguish the security classification of the information they handle.

A simplified explanation is:

Classification	Meaning
Classified	Information requiring a high level of protection
Sensitive	Information that may cause harm or adverse impact if disclosed
Open	Information that can generally be made public

The Guidelines define Classified business information to include classified information, confidential information, and certain categories of information subject to non-disclosure. Sensitive information includes other categories of information subject to non-disclosure under applicable law. Information that does not fall into either category is generally classified as Open.

4. How Should Business Functions Be Identified?

Article 39-2 identifies several sources that can be used to classify institutional functions, including:

Government and local-government function classification systems
Local education function classification systems
Public-sector database standardization requirements
The institution's own function classification system

For IT managers, this means that N2SF implementation should not begin by simply listing firewalls and servers.

The first step should be to understand:

What functions does the institution perform?

Then identify:

What information is generated, stored, processed, or transmitted by each function?

5. Public Information Can Become More Sensitive When Combined

One of the important concepts in N2SF is that the classification of information should consider not only individual data items but also their combination and linkage.

Article 39-2 allows an institution to raise the classification of information when Open or Sensitive information is combined, aggregated, or linked with higher-level information, or when information of the same classification is combined in a way that increases its importance or potential impact.

For example:

Data A + Data B

may appear harmless individually.

But:

Data A + Data B + Data C

could potentially reveal information that is significantly more sensitive.

This is particularly important when designing:

Data warehouses
Big-data platforms
AI analytics
Data lakes
Integrated administrative systems

6. The Second Key Principle: Process Information in an Appropriate Environment

After classifying information, the next question is:

Where should the information be processed?

Article 39-3 establishes the principle that business information should be processed in an information system or domain having the same or higher security classification.

For example:

Classified information → Classified or higher-level environment

Sensitive information → Sensitive or higher-level environment

Open information → Open or higher-level environment

However, the Guidelines allow information to be processed in a lower-classification system or domain when the security controls specified in the N2SF security guideline are satisfied.

Therefore, the key question is not simply:

"Can this information be processed in a lower-level system?"

The more appropriate question is:

"Are the required security controls implemented and satisfied?"

7. Minimize Mixing Different Information Classifications

Article 39-3 also states that, as far as practicable, a single information system or domain should process information of a single classification and that mixing different classifications should be minimized.

This principle is important because mixing different classifications in one system can make security management much more complicated.

For example, if one database contains:

Public website data
Internal administrative information
Sensitive operational information

then access control, encryption, logging, monitoring, backup, and external-interface policies may need to be handled differently for each category.

Therefore, information classification should be reflected in the system architecture from the planning stage.

8. The Third Key Principle: Consider the Location of Information Systems

Article 39-4 states that, as far as practicable, information systems within a single domain should have a single classification, and the mixing of systems with different classifications should be minimized.

Conceptually, an architecture might look like:

[Classified Domain]
   └─ Classified Information Systems

[Sensitive Domain]
   ├─ Sensitive Information System
   └─ Sensitive Information System

[Open Domain]
   ├─ Public Web Server
   └─ Open Information System

Actual public-sector environments can be considerably more complicated because of cloud services, shared infrastructure, inter-system connections, and data exchange.

Therefore, N2SF should not be interpreted simply as "create three separate networks."

It is better understood as:

Connect the classification of information, information systems, and domains, and then apply appropriate security controls.

9. The Fourth Key Principle: Security Controls

Article 39-5 is particularly important.

It defines the differentiated security controls for domains, information systems, and business information as the National Network Security Framework (N2SF).

Where the National Cybersecurity Basic Guidelines do not specify a particular matter, the security-control requirements of the N2SF Security Guideline distributed by the National Intelligence Service are to be followed.

Therefore:

Classification alone is not N2SF.

The classification must lead to actual security controls.

Depending on the system and identified threats, relevant controls may include:

Authentication
Access control
Network access control
Data protection
Encryption
Logging and monitoring
Malware protection
Vulnerability management
Security monitoring
Backup and recovery
External interface controls
Cloud security
AI service controls

The N2SF security guideline presents a five-stage approach:

Prepare → Categorize → Identify → Select → Assess

10. The Five N2SF Steps

① Prepare

Identify the organization's business functions, information services, systems, infrastructure, and external connections.

Key questions include:

What business functions exist?
What information is processed?
Which systems process the information?
Where are the systems located?
What external services are connected?
Is cloud computing used?
Is AI used?

② Categorize

Classify business information and information systems as:

C — Classified
S — Sensitive
O — Open

The important point is that information, information systems, and their environments should be considered together.

③ Identify

Identify threats affecting the overall service environment.

Potential threats may include:

Internet-based attacks
Account compromise
Insider threats
Data leakage
API vulnerabilities
Malware
Supply-chain attacks
Unauthorized data use
Risks associated with external AI services

The N2SF guideline emphasizes identifying threats across the overall information-service environment, not just individual systems.

④ Select

Select security controls appropriate to the identified threats and information classifications.

For an Internet-facing Open system, this may involve strong web security, access control, vulnerability management, logging, and monitoring.

For a Sensitive system, stronger access and data-protection measures may be necessary.

⑤ Assess

Finally, assess whether the selected security controls actually address the identified threats.

If necessary, additional controls should be added or the architecture should be modified.

Thus, N2SF should be viewed as a continuous process:

Classify → Identify threats → Select controls → Assess → Improve

11. What Does N2SF Mean for Internet Connectivity?

A common question is:

"Can an Open information system connect to the Internet?"

Article 39-5 states that, provided the N2SF security controls are not violated, an Open domain or information system may communicate with the external Internet, and an Open information system may be placed on the external Internet.

This does not mean:

Open = automatically safe to connect to the Internet.

Rather, it means:

Internet connectivity can be considered when the required security controls are satisfied.

KISA has also described N2SF as a move toward differentiated security controls based on information importance rather than applying a uniform network-separation approach to every type of information.

12. N2SF and Cloud Computing

Cloud computing makes information classification even more important.

The National Cybersecurity Basic Guidelines define the Sensitive domain to include external cloud-computing environments used by institutions, and the Open domain can also include external networks or cloud-computing environments used by institutions.

Therefore, when adopting cloud services, an IT manager should not ask only:

"Is this an approved cloud?"

Instead, the organization should consider:

What information → which cloud environment → what security controls → what external connections?

The National Cybersecurity Basic Guidelines also contain separate requirements for cloud-computing security, so N2SF should be considered together with applicable cloud-security requirements.

13. Why N2SF Matters for Generative AI

Generative AI is another area where information classification becomes critical.

Suppose an employee wants to enter internal business information into an external AI service.

The important questions are:

What is the classification of the information?
Is the information transmitted outside the organization?
How does the AI service process the information?
Is the information retained?
Can it be combined with other information?
What security controls are implemented?
Are relevant AI-security requirements satisfied?

The principle in Article 39-2 regarding the increased classification of information through aggregation and linkage is particularly relevant to AI and data analytics environments.

14. A Practical N2SF Workflow for IT Managers

A public-sector IT manager can organize an N2SF project as follows.

Step 1. List business functions

Document the organization's major functions.

Step 2. Identify business information

Identify information generated and processed by each function.

Step 3. Classify information

Assign Classified, Sensitive, or Open classifications.

Step 4. Map information to systems

Identify which systems create, store, process, or transmit each information category.

Step 5. Identify domains and locations

Determine the logical and physical environments where the systems operate.

Step 6. Identify external connections

Document Internet, cloud, SaaS, AI, API, and inter-agency connections.

Step 7. Identify threats

Analyze threats associated with each service.

Step 8. Select security controls

Select appropriate N2SF controls.

Step 9. Document the security measures

Reflect the controls in the project's security architecture and security plans.

Step 10. Assess and improve

Verify implementation and make necessary improvements.

15. Seven Practical Points to Remember

① Do not start with network architecture

Start with:

Business → Information → System → Domain → Security Controls

rather than beginning with network devices.

② Do not automatically classify everything at the highest level

Over-classification can reduce usability and data utilization.

Under-classification can create security risks.

Classification should therefore be based on documented criteria.

③ Consider data aggregation

Information that appears harmless individually can become sensitive when combined.

④ Connect information classification with system design

Classification must be reflected in the actual architecture.

⑤ Identify external connections

Pay particular attention to:

APIs
Cloud
SaaS
AI
Inter-agency systems

⑥ Consider existing systems

N2SF is not only for new systems.

Existing systems should also be reassessed when they are modernized, migrated to cloud environments, or connected to new services.

⑦ Use related security guidelines together

N2SF should be considered together with other applicable requirements, especially for cloud and AI projects.

KISA's N2SF demonstration casebook also recommends considering each institution's network configuration, interconnected systems, security policies, and infrastructure characteristics when designing an N2SF environment.

16. How Should We Understand N2SF and Network Separation?

It would be misleading to think of N2SF simply as:

"Network separation vs. N2SF."

Under Article 39-5, institutions may block or separate communication between domains or information systems with different classifications when implementing N2SF security controls.

Therefore, network separation can remain one of the security-control mechanisms used within an N2SF environment.

The key point is that the appropriate security control should be selected according to information classification, threats, system architecture, and operational requirements.

17. Questions to Ask During Information-System Planning

Business

What business function is being digitized?
How important is the function?

Information

What business information is processed?
What is its classification?
Can it be combined with other information?

Systems

Which systems process the information?
Are different classifications mixed within one system?

Network

Which domain is used?
Is the system connected to the Internet?
Does it communicate with systems of different classifications?

Cloud

Is an external cloud used?
What classification of information is processed there?

AI

Is generative AI or another AI service being used?
Is business information transmitted to an external AI service?

Security

What threats exist?
Which controls are required?
Are those controls actually implemented?

18. N2SF in One Sentence

N2SF is neither simply a network-separation policy nor merely a network-security technology.

It is better understood as:

A security framework that identifies organizational functions, classifies business information as Classified, Sensitive, or Open, connects those classifications to information systems and domains, identifies threats, and applies appropriate security controls.

The May 2026 revision of the National Cybersecurity Basic Guidelines formally incorporates this framework into Chapter 3, Section 1, covering information classification, information processing, system placement, and security controls.

For public-sector IT managers, perhaps the most important change in perspective is this:

Do not start by asking, "Which network should this system be placed on?"
Start by asking, "What information does this business process, how important is it, and what protection does it require?"

That approach provides a practical foundation for designing secure environments involving cloud computing, AI, SaaS, external services, and inter-agency data exchange.

The N2SF flow to remember

Identify Business → Identify Information → C/S/O Categorization → Map Systems & Domains → Identify Threats → Apply Security Controls → Assess and Improve

This is the basic flow that public-sector IT managers should keep in mind when applying N2SF to information-system projects.