Information Security
Information Security Measures and Actions
To continue improving its information security controls and overall security maturity, KGI Life launched its zero trust initiative and completed the procurement and build-out phase of network micro-segmentation and digital identity verification for sales personnel. Under the maturity assessment in the FSC’s zero trust guidelines for the financial industry, KGI Life’s overall zero trust maturity is above the industry average: it leads its peers in the identity and device dimensions and continues to strengthen the network dimension.
Establish a Security Operation Center (SOC)
KGI Life has established a 24/7 Security Operation Center for real-time threat detection and incident monitoring, enhancing its information security incident monitoring capabilities. By integrating its security monitoring platform with a Security Information and Event Management (SIEM) system, it can perform multi-dimensional correlation analysis. Its security analysts then interpret this data to provide precise judgements and recommendations to ensure real-time incident notifications and alerts. The Company joined the financial sector’s joint cyber-defense initiative (F-SOC), which integrates the intelligence-sharing platform, strengthens the joint defense monitoring system and enhances its in-progress monitoring capabilities, and it actively participates in F-ISAC intelligence sharing.
KGI Life has engaged a professional third-party vendor to provide 24/7 monitoring of its internet-facing digital assets and systems, strengthening its security monitoring capabilities.
KGI Life has engaged a professional third-party vendor to provide 24/7 monitoring of its internet-facing digital assets and systems, strengthening its security monitoring capabilities.
Participation in Joint Information Security Defense
KGI Life is one of the first official members of the Financial Information Sharing and Analysis Center (F-ISAC), a center promoted by the Financial Supervisory Commission (FSC). We continuously share de-identified detection and blocking intelligence generated by KGI Life’s security equipment for F-ISAC’s integrated analysis. We also provide security-related intelligence to the Ministry of Justice’s Investigation Bureau, expanding the effectiveness of joint financial defense. The FSC commended KGI Life for its outstanding performance in intelligence sharing, recognizing the Company’s joint defense and security monitoring efforts.
The Company has adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 (CSF 2.0), implementing controls across the six functions of Govern, Identify, Protect, Detect, Respond, and Recover. KGI Life has built a multi-layered, defense-in-depth architecture that extends from the endpoint to the network, supported by automated response mechanisms (including 7x24 SOC monitoring, SIEM, MDR, NDR, WAF, DDoS mitigation, and SOAR). The Company also maintains a real-time intelligence-sharing channel within the KGI Financial group, holding monthly exchanges with KGI Financial and its banking, securities, and investment trust subsidiaries on risk control, technology, and governance, and proactively sharing its own overall security implementation status, which strengthens joint defense across the group.
The Company has adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 (CSF 2.0), implementing controls across the six functions of Govern, Identify, Protect, Detect, Respond, and Recover. KGI Life has built a multi-layered, defense-in-depth architecture that extends from the endpoint to the network, supported by automated response mechanisms (including 7x24 SOC monitoring, SIEM, MDR, NDR, WAF, DDoS mitigation, and SOAR). The Company also maintains a real-time intelligence-sharing channel within the KGI Financial group, holding monthly exchanges with KGI Financial and its banking, securities, and investment trust subsidiaries on risk control, technology, and governance, and proactively sharing its own overall security implementation status, which strengthens joint defense across the group.
Implementation of Zero Trust Architecture
Following its zero trust architecture (ZTA) blueprint, KGI Life continues to advance the related initiatives and has completed its network micro-segmentation analysis and digital identity verification for sales personnel.
• Network Micro-segmentation Analysis
The Company analyzed network micro-segmentation, evaluating leading market solutions on enforcement point location, visibility, policy models, environment support, and cost, and also assessed the feasibility of building a solution in-house. Given the challenges of self-building, including poor visibility, policy inconsistency, enforcement fragmentation, and a lack of testing capabilities, the Company decided to use a commercial solution.
• Digital Identity Verification for Sales Personnel
KGI Life evaluated the suitability and technical merits of various FIDO (Fast Identity Online) models and, after proofs of concept with several commercial solutions, selected a Native App Centralized Verification Mode. This approach ensures the best user experience and highest security within its existing app architecture. The procurement process is complete, and KGI Life plans to pilot the solution in 2025, with a gradual rollout to all agents.
• Network Micro-segmentation Analysis
The Company analyzed network micro-segmentation, evaluating leading market solutions on enforcement point location, visibility, policy models, environment support, and cost, and also assessed the feasibility of building a solution in-house. Given the challenges of self-building, including poor visibility, policy inconsistency, enforcement fragmentation, and a lack of testing capabilities, the Company decided to use a commercial solution.
• Digital Identity Verification for Sales Personnel
KGI Life evaluated the suitability and technical merits of various FIDO (Fast Identity Online) models and, after proofs of concept with several commercial solutions, selected a Native App Centralized Verification Mode. This approach ensures the best user experience and highest security within its existing app architecture. The procurement process is complete, and KGI Life plans to pilot the solution in 2025, with a gradual rollout to all agents.
Information Security Incident Reporting and Response Mechanism
Leveraging the resources and support of the KGI Financial group, KGI Life has established an internal, cross-functional Information Security Incident Handling Team. It is also a member of the group-wide Computer Information Security Incident Response Team. This allows for timely response and support during security incidents, minimizing potential damage. Furthermore, as major incidents often affect multiple institutions, KGI Life is an active member of the F-ISAC. This joint defense mechanism enhances its risk control and cross-institutional response capabilities. No major information security incidents occurred in 2025.
Through annual attack-and-defense drills and participation in regulatory-led major incident response exercises, KGI Life identifies gaps in its defenses and refines its incident response procedures. Its active participation and willingness to share its experiences with peers in these drills were recognized with a letter of appreciation from the competent authority.
Through annual attack-and-defense drills and participation in regulatory-led major incident response exercises, KGI Life identifies gaps in its defenses and refines its incident response procedures. Its active participation and willingness to share its experiences with peers in these drills were recognized with a letter of appreciation from the competent authority.
Personal Data Protection and Management System
KGI Life has implemented a Personal Information Management System (PIMS) based on the BS 10012:2017 standard, embedding data protection into its corporate culture. The Company has expanded the scope of its PIMS certification to all departments and established a framework for assessing the applicability of the EU’s General Data Protection Regulation (GDPR). KGI Life undergoes annual external audits and has passed its BS 10012 recertification.
The Company has a Personal Data Protection Management Committee, chaired by the President, which meets semi-annually to report on the overall data protection program. KGI Life also has a Personal Data Protection Audit Team, staffed by certified PIMS lead auditors, which reviews whether its data management, management procedures, and security controls are implemented as planned and conducts internal audits.
KGI Life has established procedures for responding to and reporting personal data incidents for proper and timely incident handling. Its Personal Information Incident Emergency Response Team applies the reporting procedures and response measures appropriate to each member’s duties and the severity of the incident to contain the damage. After an incident is resolved, the Company conducts a review to identify and implement corrective and preventive measures. KGI Life also conducts annual drills based on real case studies to enhance its response capabilities.
The Company has a Personal Data Protection Management Committee, chaired by the President, which meets semi-annually to report on the overall data protection program. KGI Life also has a Personal Data Protection Audit Team, staffed by certified PIMS lead auditors, which reviews whether its data management, management procedures, and security controls are implemented as planned and conducts internal audits.
KGI Life has established procedures for responding to and reporting personal data incidents for proper and timely incident handling. Its Personal Information Incident Emergency Response Team applies the reporting procedures and response measures appropriate to each member’s duties and the severity of the incident to contain the damage. After an incident is resolved, the Company conducts a review to identify and implement corrective and preventive measures. KGI Life also conducts annual drills based on real case studies to enhance its response capabilities.