The Bureau regards cyber security as a continuous duty of sovereign administration, not an occasional response to disorder. Its doctrine joins self-reliance in technology with exact reporting, collective responsibility and vigilance in every entrusted workplace.
Cyber defence is treated as a continuous administrative duty rather than a technical speciality exercised after disorder appears. Every institution holds a defined stake of the national network: its own equipment, its own records, its own responsible officers. The Bureau does not substitute its authority for that responsibility; it verifies, coordinates and instructs correction where conditions require it.
The doctrine rests on four foundations — self-reliance, uninterrupted vigilance, service to the people's work, and exact accounting. Each foundation imposes a practical obligation on the ordinary working day of an institution: a baseline that is written down, a record that is truthful, a copy that restores, and an officer whose name is attached to the duty.
The State Cyber Security Bureau of the Democratic People's Republic of Korea shall organize protective oversight of the information systems entrusted to its jurisdiction. Its work shall uphold the sovereignty of the homeland, the continuity of essential services and the integrity of official information. All technical measures shall proceed under assigned authority, recorded responsibility and the applicable administrative procedures of the competent organs.
The Bureau reports to the National Defence Commission and coordinates implementation with provincial People's Committees. Institutions shall designate responsible liaison officers and maintain current contact arrangements. Directions affecting several institutions shall identify the coordinating organ, reporting deadline and service priorities. Coordination shall strengthen unified action without obscuring the individual responsibility of each institution for its equipment, personnel and operational decisions.
Inspections shall establish actual technical conditions through records, observation and authorized testing. Findings must distinguish immediate hazards, material deficiencies and matters requiring further examination. Each corrective instruction shall name a responsible officer and a completion date. Closure requires evidence that the condition has been corrected; an acknowledgement of receipt or a general assurance shall not be accepted as proof of completion.
An institution discovering a suspected security incident shall protect human safety, preserve available records and notify its designated reporting authority without unnecessary delay. Initial reports may state uncertainty but shall not invent certainty. They shall identify affected services, known times, actions already taken and assistance required. Subsequent reports shall correct earlier errors openly and maintain a coherent record of decisions.
Official information shall be handled according to its assigned protection requirements and operational necessity. Access, copying, transfer and disposal must remain accountable to designated custodians. Investigation records shall be protected against unauthorized alteration while avoiding unnecessary collection of unrelated material. Personnel shall use approved communication channels and shall not place operational evidence, credentials or protected documents on public submission services.
Every directorate shall maintain a training programme corresponding to its duties and the conditions of the systems it protects. Readiness shall be demonstrated through supervised exercises, accurate handovers and verified restoration tasks. The Fifth Directorate shall consolidate lessons and revise doctrine where necessary. Commendations shall recognize measurable service, sound judgement, assistance to comrades and faithful observance of established duty requirements.
No single device constitutes a secure institution. The Bureau requires mutually supporting safeguards, verified responsibilities and restoration capacity throughout the service lifecycle.
Facilities shall maintain controlled entry, recorded maintenance visits and clear custody of equipment. Server halls and cable routes require scheduled inspection, with CHONGMU teams assigned where appropriate. Any physical anomaly must be referred to qualified personnel before equipment is returned to ordinary service.
Access shall correspond to an assigned duty and a documented approval. Shared privileged credentials are prohibited except under formally controlled emergency arrangements. Responsible officers review dormant accounts, administrative rights and contractor access, recording removal decisions and confirming that departing personnel no longer retain access.
Institutions shall document network zones and permit only approved communication between them. Boundary changes require review, a restoration plan and verification after implementation. Routing observations and gateway records are examined together so that apparent service normality does not conceal an unauthorized alteration of network pathways.
System owners shall retain useful security records, synchronize approved time sources and maintain an inventory of supported software. Updates are assessed in representative environments before deployment. Unusual events receive a named reviewer, an initial assessment and a deadline for resolution or further authorized investigation.
Recovery arrangements shall include protected copies, known restoration dependencies and personnel authorized to declare service readiness. Exercises must demonstrate restoration rather than merely confirm that backup tasks completed. Lessons are entered into corrective registers and checked at subsequent inspections until responsible officers verify their closure.
Protect the physical layer; account for every authority; control the boundary; observe and maintain the system; prove that service can be restored. Where one layer is weak, the remaining layers must still hold until correction is verified.
The Bureau reports to the National Defence Commission and coordinates with provincial People's Committees. Findings enter a corrective register, and closure requires evidence rather than assurance. Commendation and correction are applied through the same standard: what was actually done, by whom, and with what measurable result for the protection of the homeland.