While upgrading the "Rules on Information Management" for users and the "Rules on IT Security" for system administrators, we operate and control information risk management, and continue education activities through performing self-assessment, e-learning, etc. one by one.