SK bioscience operates the Enterprise Risk Management(ERM) system to manage financial and non-financial risks that may arise from business activities in an integrated manner. The primary goal of the ERM is to minimize the likelihood of risks materializing and negatively impacting the business. To achieve this, risk factors related to our business are selected as priority management tasks and managed intensively. The general manager of the ERM is the Head of Legal & Patent Office, and the divisions in charge of each priority management task lead risk mitigation activities.

As the control tower of the ERM, the Legal & Patent Office identifies the status of risk management, supports management activities, and regularly reports operational results to the top management. In addition, non-financial risks related to ESG are reported to the Board through the ESG Committee. Moreover, we prioritize a long-term perspective in ERM operations to effectively respond to risks that dynamically change based on the internal and external business environment.

Other ESG-related non-financial risks

• 이사회
• ESG위원회
• ESG위원회 사무국

SK bioscience has established a risk management framework based on the Risk Framework of ISO 31000 and the COSO framework, which are international standard certifications. We take an integrated approach to risk management by encompassing identification, measurement, and assessment of the risks for existing priority management tasks and new tasks that may be identified in the future. Additionally, we conduct systematic risk management activities by continuously monitoring potential emerging risks stemming from changes in the internal and external business environment and establishing proactive response measures to them.

리스크 식별 - 측정 - 관리 - 평가로 이어지는 프로세스 정립

리스크 식별&측정을 통한 체계적 리스크 기반 마련

• 리스크 식별

  리스크의 정의 (oiep)

  조직의 목표(objective) 달성에 영향(impact)을 끼치는 사건(events)의 발생 가능성(probability)

  이미 발생한 사건과의 구별

  사건은 이미 발생하였으므로 리스크가 아님

  적절한 사후 대응이 최선의 관리(Management)

  식별, 측정가능성

  식별과 측정이 가능해야 리스크 관리 가능

• 리스크 측정

  리스크 측정

  발생가능성 및 영향도를 기준으로 - Risk level 측정 (High/Medium/Low) - High Risk부터 중점관리과제로 관리

  영향도,중점관리과제,발생가능성

• 리스크 관리활동 및 관리효과 평가

  현재 Risk Level 평가

  각 과제별로 수행한 리스크 관리활동을 기반으로 현재 Risk Level을 평가

  영향도,중점관리과제,발생가능성, 관리전/후 : 평가/의견 구성요소별 평가 및 의견

• 향후 진행 계획 수립

  향후 관리 주체 설정

  각 과제의 리스크 영향도, 발생가능성 및 현재 Risk level을 고려하여 - 전사 차원에서의 계속 관리 또는 - 현업부서에서의 관리 여부 결정

  ERM 계속 관리

  현업부서 관리

  향후 계획 수립

  각 과제별 관리주체가 기존 계획 대비 미비점을 분석하고 신규 계획을 주도적으로 수립하여 이행

Information Security Management System

Starting with the revision of security-related policies, SK bioscience has designated an information protection officer and established an information security management system centered on a dedicated information protection team. In addition, all of our information protection-related policies and procedures are continuously updated in accordance with compliance regulations and changes in the internal work environment. In 2023, we appointed individuals in charge of security for each department who are tasked with disseminating security training and checkpoints within their respective departments, to manage information protection issues. In 2024, SK bioscience is enhancing security in the evolving IT/OT environment and further advancing asset protection activities in the cloud environment.

Information Protection Division

The SK bioscience information protection division’s tasks are managed and supervised by C-level executives. The tasks are divided into three detailed areas which are technical security, privacy, and physical security. Each area is led by a manager, and in the case of physical security, we have allocated a manager at the HQ and Andong L HOUSE respectively. Going forward, we have appointed a personnel with expertise in information protection as the Chief Information Protection Officer, and put our effort to achieve a level of management that corresponds to international standards.

정보보호 총괄 임원

• 기술보안

  정보보호 책임자 (CISO)

  정보보호관리자

• 개인정보보안

  개인정보보호 책임자 (CPO)

  개인정보보호관리자

• 물리보안

  본사 물리보안 책임자

  본사 물리보안 관리자

  물리보안

  L House 물리보안 책임자

  L House 물리보안 관리자

Information Protection Goals

SK bioscience effectively and reliably protects corporate assets by controlling information leakage routes through information protection and specifying procedures and the roles and authorities of personnel in charge to ensure necessary security measures are implemented. We conduct information protection activities that meet the standard requirements of international standards such as GMP, and strengthen our IT security control system and external data security by reflecting ISO 27001 standard which is the information protection and privacy management system.

Since 2022, SK bioscience has maintained ISO 27001 certification, identifying risk factors in the field of information security. The Company adheres to the standards for publicly listed companies in Korea by annually disclosing transparent security activities through information protection disclosures. Through these efforts, we are committed to enhancing our security capabilities at a global level and earning the trust of our global partners by obtaining international standard certifications.

Prevention of and Response to Cybersecurity Incidents

To prevent and respond to cybersecurity incidents, SK bioscience conducts regular inspections of major systems and strengthens the security review process upon the introduction of new solutions. In addition, we conduct simulated phishing every half year to diagnose vulnerabilities and establish safe business systems through continuous management.

At each simulation training, we send a total of two warning emails to employees who had their computers infected with malware and carry out PC scans and checks. In addition, we conduct DDoS simulation training in the second half of each year to check the detection and blocking abilities of our security systems and the availability of security equipment by conducting three simulated attacks consisting of prevalent and new attack types.

DDoS Simulation Training Procedure

1. 공격장비 방어장비 구성
2. DDoS 훈련대상 선정
3. 공격 유형 설정
4. 1차, 2차, 3차 공격 시도
5. 탐지 및 차단 결과 확인

Information Security Activities and Training

SK bioscience’s company-wide IT system is kept safe from internal and external threats such as information leakage through remote control services provided by a professional security company. To instill a culture of security among employees and preemptively control internal information leaks, SK bioscience designates an annual "Company-wide Security Day." On this day, employees perform self-checks on life security, document security status, and work devices. Penalties are imposed on violators to prevent recurrence. As a result, the security check violation rate significantly decreased from 30.8% in 2022 to 10.9% in 2023. We also try to create an information protection culture by sharing monthly malicious/phishing mail trends and new security threat cases via the Company notice board.

Furthermore, we conduct regular privacy and security training for our employees, including new hires and employees of our business partners to strengthen security awareness and raise awareness of information leaks. The training program is updated annually to deliver customized privacy and information security training.