An operation method of a UE in a communication system includes receiving, from a base station, a security mode command message including information requesting reporting of capability information and security configuration information; identifying the security configuration information included in the security mode command message; and transmitting, to the base station, a security mode complete message including the capability information requested by the security mode command message.