The enterprise security landscape is changing quickly.
In the past, protecting internal systems from external threats meant separating networks and reinforcing the perimeter — a security model built around network separation. But as workplaces have diversified with cloud adoption,
remote work, and external collaboration, network boundaries alone are no longer enough to protect data.
What matters now is identifying which information is critical and applying the right security controls to it.
N2SF (National Network Security Framework), currently being rolled out with a focus on Korea's public sector,
reflects exactly this shift in the security environment.
So what is N2SF — and how should enterprise document security change in response?
A shift in the security paradigm: from network-centric to data-centric
The core idea behind N2SF is to move away from uniform network separation and
instead apply security at differentiated levels, based on the importance of the data and the nature of the work involved. Business information is classified into Classified (C), Sensitive (S), and Open (O) levels, and policies are applied according to each level and to the party requesting access.
| Network-centric security (past) | Data-centric security / N2SF (present) |
Security criterion | The network you connect from (internal / external) | The importance and security level of the data (C / S / O) |
Control method | Uniform blocking or permission based on the access route | Differentiated control based on who is accessing and the scope of their work |
Core challenge | Building a secure network perimeter | Identifying and protecting critical information |
Classifying documents isn't where the work ends
So what should a company do first when preparing for data-centric security?
Identifying documents and classifying them by level is an important starting point.
But without continuous management after classification, the approach runs into limits.
The heart of data-centric security, then, goes beyond "how do we classify documents?" to
"how do we keep managing classified documents in real, everyday work environments?"
A document centralization solution: the foundation for data-centric security
A document centralization solution allows a company to manage its documents centrally,
and provides an environment where access rights and document usage can be controlled at the user level.
This makes it possible to apply consistent security policies to classified documents and
manage them on an ongoing basis.
① Centralized document management Documents scattered across personal PCs and
individual storage are managed centrally, so company documents can be governed by a single, consistent standard.
② Access rights by user Permissions can be set so that users access only the documents they need,
based on department, project, user, and other characteristics of their work.
This keeps document access aligned with what each role actually requires.
③ Control over document usage rights Even users who are allowed to view a document don't necessarily need free rein over every function — downloading, editing, printing. Usage rights can be separated and
managed according to the nature of the document and the work environment.
④ Control over external release When documents need to be shared externally for business reasons,
the release process can still be managed. Documents that require external sharing can be distinguished
from those that don't, with approval workflows applied where necessary.
⑤ Document usage history Access and usage history is recorded, making it possible to see how documents are actually being used. This helps organizations understand the current state of document management and
supports audits when needed.
Security shifts from "where it is" to "what you're protecting"
Recent changes in the security environment, N2SF among them,
show how the perspective on enterprise security has shifted.
Where the priority was once building a secure network, the priority now is identifying the critical data inside that network and granting access only to the people who need it, only to the extent they need it.
Going beyond document classification to build a document centralization environment that can genuinely protect and manage classified data — that is the surest first step toward a successful N2SF transition and truly data-centric security.
The enterprise security landscape is changing quickly.
In the past, protecting internal systems from external threats meant separating networks and reinforcing the perimeter — a security model built around network separation. But as workplaces have diversified with cloud adoption,
remote work, and external collaboration, network boundaries alone are no longer enough to protect data.
What matters now is identifying which information is critical and applying the right security controls to it.
N2SF (National Network Security Framework), currently being rolled out with a focus on Korea's public sector,
reflects exactly this shift in the security environment.
So what is N2SF — and how should enterprise document security change in response?
A shift in the security paradigm: from network-centric to data-centric
The core idea behind N2SF is to move away from uniform network separation and
instead apply security at differentiated levels, based on the importance of the data and the nature of the work involved. Business information is classified into Classified (C), Sensitive (S), and Open (O) levels, and policies are applied according to each level and to the party requesting access.
Network-centric security (past)
Data-centric security / N2SF (present)
Security criterion
The network you connect from (internal / external)
The importance and security level of the data (C / S / O)
Control method
Uniform blocking or permission based on the access route
Differentiated control based on who is accessing and the scope of their work
Core challenge
Building a secure network perimeter
Identifying and protecting critical information
Classifying documents isn't where the work ends
So what should a company do first when preparing for data-centric security?
Identifying documents and classifying them by level is an important starting point.
But without continuous management after classification, the approach runs into limits.
The heart of data-centric security, then, goes beyond "how do we classify documents?" to
"how do we keep managing classified documents in real, everyday work environments?"
A document centralization solution: the foundation for data-centric security
A document centralization solution allows a company to manage its documents centrally,
and provides an environment where access rights and document usage can be controlled at the user level.
This makes it possible to apply consistent security policies to classified documents and
manage them on an ongoing basis.
① Centralized document management Documents scattered across personal PCs and
individual storage are managed centrally, so company documents can be governed by a single, consistent standard.
② Access rights by user Permissions can be set so that users access only the documents they need,
based on department, project, user, and other characteristics of their work.
This keeps document access aligned with what each role actually requires.
③ Control over document usage rights Even users who are allowed to view a document don't necessarily need free rein over every function — downloading, editing, printing. Usage rights can be separated and
managed according to the nature of the document and the work environment.
④ Control over external release When documents need to be shared externally for business reasons,
the release process can still be managed. Documents that require external sharing can be distinguished
from those that don't, with approval workflows applied where necessary.
⑤ Document usage history Access and usage history is recorded, making it possible to see how documents are actually being used. This helps organizations understand the current state of document management and
supports audits when needed.
Security shifts from "where it is" to "what you're protecting"
Recent changes in the security environment, N2SF among them,
show how the perspective on enterprise security has shifted.
Where the priority was once building a secure network, the priority now is identifying the critical data inside that network and granting access only to the people who need it, only to the extent they need it.
Going beyond document classification to build a document centralization environment that can genuinely protect and manage classified data — that is the surest first step toward a successful N2SF transition and truly data-centric security.