Understanding Article 52 of the National Cybersecurity Basic Guidelines: Online Maintenance Through Designated Terminals

A Practical Guide for IT and Information-System Managers in Korean Public Institutions

Public institutions operate a wide range of information systems, including administrative systems, websites, databases, infrastructure platforms, and other critical services.

These systems require regular maintenance for software updates, security patches, configuration changes, troubleshooting, and emergency recovery.

Traditionally, maintenance engineers visited the institution and performed maintenance on site. Today, however, Internet-based remote maintenance is increasingly common because it can reduce response time and operating costs.

Remote maintenance is convenient, but it also introduces cybersecurity risks.

If a maintenance contractor's account is compromised, for example, an attacker may attempt to use that account as a pathway into the institution's information systems.

To address these risks, the National Cybersecurity Basic Guidelines establish specific security requirements in Article 52, "Online Maintenance Through Designated Terminals."

The current guideline was revised on May 1, 2026, and the revised provision places particular emphasis on designated terminals, access control, multi-factor authentication, and online service-control systems.

1. Why Is Article 52 Important?

The primary advantage of online maintenance is speed.

For example, suppose an institution's web server suddenly experiences a service problem. Instead of waiting for a maintenance engineer to travel to the institution, the engineer may be able to diagnose and resolve the problem remotely.

However, this convenience creates security risks.

Potential risks include:

Compromise of a maintenance contractor's account
Malware infection of the contractor's computer
Exposure of remote-access pathways
Excessive system privileges
Unauthorized access
Difficulty determining who accessed the system
Leakage of sensitive information during maintenance

Therefore, online maintenance should not simply be treated as "installing remote-access software."

The essential security question is:

Who accessed the system, from which terminal, through which access path, to which system, and when?

Article 52 is designed to provide controls for these questions.

2. Understanding the Relationship Between Articles 51 and 52

Article 51 should be considered together with Article 52.

Article 51 establishes that when an information system is maintained directly or through a contractor, access should be permitted only from a console or designated terminal.

In simple terms:

Information-system maintenance should not be performed from an arbitrary computer.

Article 52 then specifies the security controls that must be applied when online maintenance through the Internet is permitted.

Therefore, Article 52 should not be interpreted as a general permission for unrestricted remote maintenance.

It is better understood as:

"If online maintenance is necessary, what security controls must be established before allowing it?"

3. What Systems Are Covered?

Under the revised Article 52, an institution may allow a maintenance contractor to perform online maintenance through the Internet when the institution determines that such maintenance is necessary and the contractor agrees in writing to the required security measures.

The provision covers the institution's information systems, including systems handling sensitive-level information, while excluding the security and network equipment specified in Article 42(1).

This means that online maintenance is not automatically permitted simply because a contractor requests remote access.

The institution must determine whether online maintenance is necessary and whether the required security controls are in place.

4. Six Core Security Requirements

Article 52 identifies several important controls.

① Access Only from a Designated Terminal at a Designated Location

The first principle is to restrict the terminal used for maintenance.

A contractor should not simply use any personal laptop or ordinary office computer to connect to the institution's system.

The guideline requires access from a designated terminal installed at a designated location, with controls over the personnel who can access that terminal, including multi-factor authentication.

A simplified architecture is:

General remote access

Contractor → Internet → Institution's system

versus:

Controlled online maintenance

Designated location → Designated terminal → Authentication → Online service-control system → Target information system

For public-sector IT managers, this distinction is critical.

② The Designated Terminal Should Be Dedicated to the Control System

The designated terminal should be operated exclusively for accessing the online service-control system.

Other Internet access must be blocked.

The purpose is straightforward.

If a maintenance terminal can freely browse the web, use personal email, download arbitrary files, or install unrelated applications, it may become infected with malware.

Because the terminal has access to an institutional information system, such infection could create a serious security risk.

Therefore, the maintenance terminal should be managed as a dedicated security-controlled terminal, rather than as an ordinary employee workstation.

③ Access Through an Online Service-Control System

Another central concept in Article 52 is the online service-control system.

The National Cybersecurity Basic Guidelines require institutions that permit online maintenance to establish and operate a system that controls the contractor's online access.

A simple way to understand this system is:

A security gateway that controls and records the contractor's access between the maintenance environment and the institution's information systems.

A typical conceptual structure is:

Maintenance contractor

↓

Designated terminal

↓

Multi-factor authentication

↓

Online service-control system

↓

Target information system

This architecture helps the institution centrally control and monitor remote maintenance access.

5. Why Use an Intermediate Control System?

The online service-control system provides several important functions.

Access control

Only authorized maintenance personnel can connect.

Target-system control

Access can be limited to approved information systems.

Activity tracking

The institution can determine when and by whom access occurred.

Incident investigation

If a security incident occurs, access records can help investigators determine what happened.

Therefore, the system should not be viewed merely as a remote-access server.

It should be understood as a central security-control and audit point.

6. Access Logs Must Be Retained for at Least One Year

Article 52 requires access activity to be recorded and the relevant log records to be retained for at least one year.

Useful records may include:

Access date and time
User account
Source terminal
Source IP address
Target system
Authentication results
Session duration
Connection termination
Relevant maintenance activity

The exact logging scope may depend on the institution's environment and control system.

The key principle is that the institution should be able to determine:

who accessed what, when, and through which path.

Log protection is also important. Simply storing logs is not sufficient if unauthorized users can modify or delete them.

7. Security Inspections Continue Beyond the Contract Period

The security requirements do not simply disappear when the maintenance contract ends.

Article 52 allows regular or ad hoc security inspections by the contracting institution, its superior institution, and the National Intelligence Service during the period from the start of the maintenance contract until 30 days after the contract ends. Surprise inspections are also included.

This is an important reason to include security inspection and cooperation requirements in procurement and contract documents.

8. Written Agreement by the Contractor Is Important

Article 52 requires the contractor to agree in writing to the specified security measures when online maintenance is permitted.

This means that security requirements should be established before the maintenance work begins.

Article 13 also requires relevant security requirements to be reflected in procurement documents when online development or online maintenance is considered necessary.

Therefore, an RFP or statement of work should clearly specify requirements such as:

Use of designated terminals
Authorized maintenance personnel
Multi-factor authentication
Use of the online service-control system
Blocking of unrelated Internet access
Log retention
Security inspections
Security incident response
Access-right revocation after personnel changes
Access-right revocation at the end of the project

9. What If an Online Service-Control System Has Not Been Built?

Article 52 includes a limited exception.

If an institution has not established an online service-control system, direct online maintenance may be temporarily permitted for Open-level information systems, but only when failing to perform immediate maintenance is expected to cause significant disruption to institutional operations.

This exception should be interpreted carefully.

It does not mean:

"If the institution does not have a control system, remote maintenance is generally allowed."

Rather, the conditions are limited:

Immediate maintenance must be necessary.
Failure to perform the maintenance must be expected to significantly interfere with institutional operations.
The exception is limited to Open-level information systems.
It is temporary.

Therefore, this provision should be treated as an exceptional operational measure, not as a substitute for establishing an online service-control system.

10. Special Provision for National Disasters or Crisis Situations

The May 1, 2026 revision also added a provision addressing national disasters or crisis situations.

In situations covered by laws such as the Framework Act on Disaster and Safety Management or the Infectious Disease Control and Prevention Act, the institution may permit maintenance through a process involving a security review by the National Intelligence Service and consultation with the National Intelligence Service.

This means that emergency circumstances do not simply eliminate cybersecurity controls.

Instead, exceptional maintenance is subject to a defined security-review and consultation process.

11. Article 52 Should Be Read Together with Contractor Security Requirements

Online maintenance is not only a technical access-control issue.

Article 52(3) states that other security matters relating to online maintenance should follow Article 26 concerning contractor security.

Article 26 also requires institutions that permit online development or online maintenance to establish and operate an online service-control system for controlling contractor access. If the contractor fails to comply with security requirements and corrective action is considered difficult, the institution may cancel the authorization for online maintenance or terminate the contract under applicable contractual provisions.

For practical management, the relationship can be understood as:

Article 13

→ Include security requirements in the RFP and statement of work

↓

Article 26

→ Manage contractor security

↓

Article 51

→ Allow maintenance access only from a console or designated terminal

↓

Article 52

→ Apply specific controls for Internet-based online maintenance

↓

Online service-control system

→ Control, monitor, and record access

This integrated approach is more useful than considering Article 52 in isolation.

12. Practical Checklist for Public-Sector IT Managers

Planning

Before launching a maintenance project, ask:

Is online maintenance actually necessary?
Can critical maintenance be performed on site?
What is the information classification of the target system?
Is Internet-based access appropriate?
Is an online service-control system available?

Procurement

If online maintenance is required, include the relevant security requirements in the RFP and statement of work.

The guideline specifically connects online development and online maintenance security requirements with procurement documentation.

Contracting

Consider explicitly addressing:

Designated terminal requirements
Authorized personnel
Multi-factor authentication
Online service-control system
Logging
Security inspections
Incident reporting
Access-right management
Termination of access at project completion

Operation

During actual maintenance, continuously manage:

People

Who can access the system?

Terminal

Which computer is being used?

Path

Through which control system is the connection established?

Privilege

What systems and functions can the contractor access?

Records

Are access and maintenance activities recorded?

Inspection

Can the institution conduct audits and security inspections?

13. Practical Checklist

Check Item	What to Verify
Necessity	Is online maintenance genuinely necessary?
Target system	Has the target system and information classification been identified?
Designated terminal	Is access limited to a designated terminal at a designated location?
Authorized personnel	Are terminal access and maintenance personnel restricted?
Authentication	Is multi-factor authentication implemented?
Internet restriction	Is unrelated Internet access blocked?
Control system	Does access pass through the online service-control system?
Access restriction	Is access limited to approved target systems?
Logging	Are access logs retained for at least one year?
Security inspections	Can the institution respond to regular and ad hoc inspections?
Contractor agreement	Has the contractor agreed to the security measures in writing?
Procurement documents	Are online-maintenance security requirements included in the RFP/contract?
Account management	Are access rights updated when maintenance personnel change?
Project completion	Are accounts and access privileges revoked after the contract ends?
Incident response	Is there a procedure for unauthorized access or security incidents?

14. Common Misunderstandings

Misunderstanding 1: "The contractor can use its own laptop."

The designated-terminal requirement means that unrestricted use of an arbitrary contractor laptop does not satisfy the basic access-control concept of Article 52.

Misunderstanding 2: "The maintenance PC can also be used for ordinary Internet access."

The designated terminal is intended to be dedicated to accessing the online service-control system, and other Internet access should be blocked.

Misunderstanding 3: "Installing a VPN is enough."

A VPN may protect a communication path, but it does not by itself replace the broader requirements concerning designated terminals, personnel control, the online service-control system, logging, and inspections.

Misunderstanding 4: "We have logs, so security management is complete."

Logging is important, but institutions also need appropriate access controls, monitoring, log protection, and incident-response procedures.

Misunderstanding 5: "We can decide the remote-access requirements after selecting the contractor."

This can create practical and contractual difficulties.

It is preferable to define the security requirements in the procurement and contract documents before the contractor begins work.

15. The Simplest Way to Understand Article 52

The core idea of Article 52 can be summarized as follows:

Online maintenance should not be performed from an arbitrary location or computer; access and maintenance activities should be controlled through designated terminals, authentication, an online service-control system, logging, and security inspections.

The purpose of Article 52 is therefore not to prescribe a particular remote-access product.

Its focus is the overall security-control framework:

Access control + Path control + User control + Logging + Inspection

16. Seven Things IT Managers Should Remember

For practical purposes, remember these seven points:

1. Online maintenance should be allowed when it is necessary.

2. Access should be made through a designated terminal at a designated location.

3. Personnel accessing the terminal should be controlled, including through multi-factor authentication.

4. The designated terminal should be dedicated to accessing the online service-control system, with unrelated Internet access blocked.

5. Communication with the target information system should be protected and controlled through the designated control path.

6. Access logs should be retained for at least one year.

7. Security inspections may continue through 30 days after the maintenance contract ends.

The exception for institutions without an online service-control system should also be remembered: it is a temporary exception limited to Open-level information systems when immediate maintenance is necessary to avoid significant disruption to institutional operations.

17. Conclusion

Online maintenance is an important operational capability for Korean public institutions.

It can reduce response times and make system management more efficient. At the same time, remote access creates additional cybersecurity risks, including compromised contractor accounts, malware-infected terminals, unauthorized access, and information leakage.

Article 52 of the National Cybersecurity Basic Guidelines addresses these risks by establishing a controlled framework centered on:

Designated terminal → Authentication → Online service-control system → Target information system → Logging and inspection

For public-sector IT managers, online maintenance should therefore not be viewed simply as an IT convenience.

It should be regarded as a security-sensitive activity that grants external maintenance personnel access to an institutional information system.

The most effective approach is to incorporate Article 52 requirements throughout the entire project lifecycle—from planning and procurement to contracting, implementation, operation, monitoring, and project completion.

Finally, this article is an explanatory reconstruction based on the May 1, 2026 version of the National Cybersecurity Basic Guidelines and publicly available related administrative guidance. For actual implementation, institutions should always verify the latest applicable guidelines, their own internal security rules, and the requirements applicable to the specific project.