What is the National Network Security Framework (N2SF)?
N2SF, Korea's national network security framework, told as a story about rebuilding the bridge but lining it with checkpoints.
Public-sector castles have kept their bridges cut entirely.Like an island with no bridge. In reality this is network separation: the work network is physically split from the internet. No thief can get in, but no outside tool can either.
But more and more work needs outside tools.Rebuild the bridge, and the old worry about thieves comes right back.
N2SF rebuilds the bridge, but lines it with checkpoints, one after another.Ledgers are graded classified (C), sensitive (S), or open (O), with controls matched to each grade.
The old way and N2SF handle the bridge differently.N2SF's checkpoint approach resembles the castle that always asks.
The switch to N2SF is still in its early days.Not every public-sector castle has switched yet, and the grading criteria themselves are still being refined.
N2SF = the nation's new network security framework — instead of cutting the bridge entirely, it grades ledgers by sensitivity and lines the bridge with checkpoints, one after another.
N2SF is a public-sector network security framework led by South Korea's National Intelligence Service, replacing one-size-fits-all network separation with security levels set by how important the data is. Work information is graded classified (C), sensitive (S), or open (O), with controls matched to each grade (including zero-trust-style access control), aiming to let public institutions use cloud and other outside services while still staying protected. Guideline 1.0 came out in 2025, and the National Cyber Security Basic Guidelines revised on May 1, 2026 added an N2SF section and deleted the article on separating internal and internet networks (Article 40). These Guidelines say communication between different grades may be blocked or separated, and the grade they expressly allow to connect to the outside internet is open (O) (Article 39-5).
When grown-ups say it
- N2SF
- The nation's new network security framework. A public-sector framework led by Korea's National Intelligence Service.
- Physical network separation
- Cutting the bridge entirely. The old approach. → the island shed with no bridge
- Logical network separation
- Bridge open, but checkpointed. No physical cut — access control achieves a similar effect.
- C/S/O Grades
- The three grades given to each ledger. Classified, sensitive, and open, with the control level matched to each.
- Zero-trust based
- Every door asks again. The idea N2SF's checkpoints lean on. → the castle that always asks
- Public-sector cloud use
- Cloud allowed when it matches the ledger's grade. Something that was nearly impossible under physical separation.
- Continuous monitoring
- Watching continuously. Passing a checkpoint once isn't the end of the watching.
- Phased rollout
- Not every public institution has switched yet. The pace varies by institution, and the grading criteria themselves are still being refined.