State Cyber Security Bureau

Computer security work is an important work for guaranteeing the safety of the state and the normal work of institutions. Every institution shall faithfully uphold the leadership of the respected Comrade Kim Jong Un and shall strictly execute the relevant discipline under the unified guidance of the Bureau. The practice of leaving security work only to technical officials shall not be permitted. The responsible official shall personally grasp the whole process, from the drafting of the work plan to its execution and summary. Collective consultation and individual responsibility shall be correctly combined, and when a deviation appears its cause shall be clarified concretely and substantial measures adopted.

The documents and secret materials of an institution are the precious wealth of the state, and every member bears the duty to protect them. The drafting and transfer of materials shall proceed according to the approved scope of work and the dispatch procedure. Handing over secret materials on the ground of personal acquaintance or work convenience, or moving them to an outside storage medium, shall not be permitted. When it is not clear whether a material may be made public, the instruction of the responsible official shall be obtained. When a person in charge changes post or hands over work, the state of document transfer shall be confirmed, and no material shall be left behind.

Only approved members shall enter machine rooms and document storage places according to the established procedure. The official receiving a visitor shall confirm the purpose of the visit and the responsibility for guidance, and shall maintain order in the place concerned. Borrowing another member's name or using an entry document on another's behalf shall not be permitted. The use of machines and communication means shall proceed within the assigned scope of work, and unapproved devices shall not be connected arbitrarily. When outside personnel enter for repair or inspection, management responsibility remains with the institution concerned, and the state of order shall be confirmed after the work is finished.

A member who discovers a condition different from the ordinary in computer equipment or in the liaison order shall not treat it lightly or judge it arbitrarily, but shall report it to the responsible official. The report shall clearly reflect the circumstances of discovery and the facts confirmed at the site. Dressing speculation as fact, or delaying a report in order to avoid responsibility, shall not be permitted. The content shall not be spread to uninvolved persons, and the order of the site shall be ensured until the relevant instruction is given. The official receiving the report shall keep track of the process of handling and shall take responsibility to the end so that the problem raised is not buried.

Every institution shall regularly organise study of computer security discipline and practical training so that all members clearly know their duties and procedures of action. Study materials shall be based on approved documents, and explanatory materials received from outside shall not be used without examination. In training, formal reporting and show-piece preparation shall be rejected. The cooperation and handover order of the personnel concerned shall be examined in accordance with actual working conditions, and shortcomings found shall be reflected in the next study. Responsible officials shall not judge only by attendance, but shall concretely examine understanding of discipline and changes in practice.

Inspection of computer security work is not work whose purpose is to expose defects, but work for reliably guaranteeing the safety of the state. Inspecting members shall observe principle and fairness, and shall listen fully to the opinions of the site. A unit under inspection shall not conceal facts or dress up its actual condition by temporary expedients. For the problems raised, the defects in guiding work shall be analysed together with the responsibility of the member concerned. Corrective measures shall be discussed collectively, but the responsibility for execution shall be made clear, and work shall not be ended without actual confirmation merely because a completion report has been received.