Where security monitoring AI sits
depends on the C, S and O levels
Korea's National Network Security Framework (N2SF, 국가 망 보안체계) applies to government and public institutions. It replaces the old approach of cutting every business network off from the internet in the same way. Instead, work information and systems are sorted into Classified (C), Sensitive (S) and Open (O), with different controls for each level. Before anything else, you need to decide which level your monitoring logs belong to and which domain the analysis AI goes in.
What it requires
Korea's National Intelligence Service (NIS) released the N2SF security guidelines at the end of September 2025.
The National Cyber Security Basic Guidelines (「국가 사이버보안 기본지침」), revised on May 1, 2026, then added the level definitions and handling rules, and the old clauses separating internal networks from the internet were removed.
| Level | What information it covers (summary of the Basic Guidelines definitions) |
|---|---|
| Classified (C) | Secret and confidential information, plus some information exempt from disclosure under the Official Information Disclosure Act as specified in the guidelines |
| Sensitive (S) | Other information exempt from disclosure, material prepared at the request of the National Assembly or local councils, and similar |
| Open (O) | All other work information outside C and S, including published public data |
- Institutions have to classify their business functions and sort the work information each function handles into C, S or O.
- Open or Sensitive information can be raised to a higher level when it is combined with higher-level information, or when enough information of the same level is gathered that its importance rises.
- As a rule, work information is processed in systems and domains at the same or a higher level. It can be processed at a lower level if the security controls in the guidelines are met.
- Where possible, each domain holds systems of only one level, and communication between domains of different levels can be blocked or separated.
- The Sensitive domain also includes the external cloud areas an institution uses, and the Open domain can communicate with the internet within the scope of the security controls.
- Projects applying N2SF and the build-out of security operations centers are subject to NIS security review.
How to place security monitoring AI at each level
Monitoring logs pull records from many systems into one place, so the level can go up the moment you collect them.
That's why we first recommend a separate analysis instance for each level.
Standalone install on an air-gapped network
Genox is installed on its own inside the Classified domain with no external connection. Detection rule and model updates come in on approved media, and analysis results and verdict records stay inside the same domain. Updates arrive later, so new attack techniques are picked up more slowly. Plan for that.
On the institution's network or a dedicated cloud
Installing on the institution's network is the default. Because the guidelines include external cloud areas in the Sensitive domain, you can also consider a Korea-only dedicated cloud, but the institution first has to confirm it meets the guideline security controls, the security review, and the certification requirements for public sector cloud.
Assessing public assets and threat intelligence
External attack surface assessment of internet-facing assets such as websites and public services, and collection of public threat intelligence, can happen in the Open domain. The level may go up, though, as soon as you combine those results with internal logs for analysis.
How the requirements map to Genox features
Genox can't judge whether you comply with N2SF or go through the security review for you.
What we do is prepare the materials and configuration the institution needs to make its own decisions and applications.
| Requirement | Related Genox features / services | What you have to do yourself |
|---|---|---|
| Classifying work information | A review of the level for monitoring logs and analysis results, done as part of security consulting | Classify business functions, decide C, S or O levels, judge when to raise a level |
| Processing in a domain that matches the level | Separate instances for each level, analysis nodes with outbound transmission blocked | Design the domains and how communication between levels is blocked or separated |
| Applying security controls for each level | Documentation for access control, encryption and audit log settings for each Genox component | Select and implement the guideline security controls, judge whether they are adequate |
| Security monitoring and incident response | On-premises AI security monitoring, case-level verdicts and reasoning records from Threat Correlator | Decide monitoring scope, take action and give notice under the guidelines when an incident occurs |
| Security measures for AI systems | AI/LLM red team assessment to check injection and leakage risks in the generative AI the institution adopts | Set up security measures, apply the NIS AI security guidebook and similar guidance |
| NIS security review | Technical documentation covering architecture diagrams, data flows and whether there are external connections | Apply for the review and respond to follow-up requests |
Frequently asked questions
Can one Genox instance monitor C, S and O together?
Technically you can put everything in one instance, but we don't recommend it. The guidelines ask for one level per domain where possible, and mixing information of different levels can mean treating all of it at the higher level. A setup that's easier to manage is a separate install per level, with only result summaries passed up to a higher level through a defined procedure when needed.
Does Genox have a CC certification or a security function verification certificate?
Genox does not currently hold a Common Criteria (CC) certification or a security function verification certificate (보안기능 확인서, a Korean product verification). Certification requirements differ for each public procurement project, so please check them first at the tender notice stage.
On an air-gapped network, how are AI model updates handled?
Update files are delivered offline and brought in through the institution's own import procedure and integrity checks. Automatic updates over the internet aren't used in the Classified domain.
Which level should public threat intelligence be used at?
The raw data you collect is public, but the results of matching it against the institution's internal logs contain information about the institution's assets. It's safer to design on the assumption that matching results take on the level of the original logs.
References
- National Cyber Security Basic Guidelines (revised May 1, 2026), National Cyber Security Center, National Intelligence Service (in Korean)
- Briefing on the government-wide comprehensive information security plan, Korea Policy Briefing, October 22, 2025 (in Korean)
- National Cyber Security Center (where the N2SF security guidelines are published, in Korean)
If you have a draft classification, let's go through it together
Share your institution's draft classification and current monitoring setup, and we'll put together a placement plan for each level and a list of the materials the security review will need.