|
Article 1
|
These Regulations are stipulated in accordance with Paragraph 3 of Article 7 of the Cyber Security Management Act (hereinafter referred to as “the Act”).
|
Info
|
|
Article 2
|
The cyber security responsibility levels of the government agency or specific non-government agency (hereinafter referred to as “each agency”) are classified from high to low into Level-A, Level-B, Level-C, Level-D and Level-E.
|
|
|
Article 3
|
The Executive Yuan shall approve cyber security responsibility level of its own and submit it to the competent authority for recordation. The agencies directly subordinate to the Executive Yuan shall, every three years, propose the cyber security responsibility levels of their own, their subordinate or supervisory government agencies, and the specific non-government agencies under their charge, and shall report the same to the competent authority for approval.
Special municipality, county (city) governments shall, every three years, propose the cyber security re-sponsibility levels of their own, their subordinate or supervisory government agencies, and their gov-erned villages (townships/cities), mountain indigenous district offices of municipality, and the subordi-nate or supervisory government agencies of such governed villages (townships/cities) and mountain in-digenous district offices of special municipalities, and shall report the same to the competent authority for approval. Special municipality and county (city) councils shall, every three years, propose the cyber security responsibility levels of their own and shall report the same to the competent authority for ap-proval.
The Office of the President, the National Security Council, the Legislative Yuan, the Judicial Yuan, the Examination Yuan, and the Control Yuan shall, every three years, approve the cyber security responsibil-ity levels of their own, their subordinate or supervisory government agencies, and the specific non-government agencies under their charge, and shall submit the same to the competent authority for re-cordation.
Where each agency is required to change its cyber security responsibility levels due to adjustments to organizations or businesses, it shall immediately conduct the change to levels according to the proce-dures under the preceding three paragraphs; the same shall apply to the case when a new agency is estab-lished.
In conducting the submission or approval of cyber security responsibility levels under Paragraph 1 and Paragraph 3, where the government agency thinks it is necessary to otherwise give the entities within the government agency or the specific non-government agency the levels that are different from those of such agency, it may determine such levels in accordance with the requirements of Article 4 to Article 10, by taking into consideration the nature of businesses of such entities.
|
Info
|
|
Article 4
|
The cyber security responsibility levels of each agency under any of the following circumstances are Level-A:
1. Its business involves classified national security information.
2. Its business involves matters of foreign affairs, national defense, or homeland security.
3. Its business involves the maintenance operation of information and communication system com-monly used for nationwide people services or cross agencies.
4. Its business involves the possession of personal information of nationwide people or public offi-cials.
5. It is a government agency, and its business involves matters of nationwide critical infrastructure.
6. It is a critical infrastructure provider, and the central competent authority in charge of the relevant sector, based on the consideration of the number of users, market share, the area and the substituta-bility of its business or maintenance operation of critical infrastructures and services, considers that the failures of or impact on its information and communication system might cause disasters or ex-tremely serious impact on social public interests, people’s morale, or the security of people’s lives, body or property.
7. It is a government medical center.
|
|
|
Article 5
|
The cyber security responsibility levels of each agency under any of the following circumstances are Level-B:
1. Its business involves the security maintenance and management of national core technology information that is donated, funded, researched, or developed by the government agency.
2. Its business involves the maintenance operation of information and communication systems that are commonly used for regional or local people services or cross agencies.
3. Its business involves the possession of the archives of personal information of regional or local people.
4. Its business involves the maintenance operation of information and communication systems that are commonly used for the central secondary authority and its subordinate government agencies (insti-tutions).
5. It is a government agency, and its business involves matters of regional or local critical infrastruc-ture.
6. It is a critical infrastructure provider, and the central competent authority in charge of the relevant sector, based on consideration of the number of users, market share, the area and the substitutability of its business, or the maintenance operation of critical infrastructure and services, considers that the failure of or impacts on its information and communication system might cause serious impact on social public interest, people’s morale, or the security of people’s lives, body or properties.
7. It is a public regional hospital or local hospital.
|
|
|
Article 6
|
The cyber security responsibility levels of each agency who maintains and operates by itself or out-sources the establishment and development of cyber systems are Level-C.
The information and communication system established by itself or outsourced under the preceding paragraph, refers to the information and communication system with authority-division and management functions.
|
|
|
Article 7
|
The cyber security responsibility levels of each agency who conducts information and communication business by itself but does not maintain and operate the information and communication system that is established and developed by itself or outsourced for the development thereof are Level-D.
|
|
|
Article 8
|
The cyber security responsibility levels of each agency under any of the following circumstances are Level-E:
1. It neither has the information and communication system, nor provides the information and communication service.
2. It is a government agency, and all its information and communication business is conducted concur-rently or managed by its superior agency, supervisory agency or the agency designated by the agen-cies mentioned above.
3. It is a specific non-government agency, and all of its information and communication business is conducted concurrently or managed by its central competent authority in charge of the relevant sec-tor, the subordinate government agency of the central competent authority in charge of the relevant sector, the specific non-government agency under their charge by the central competent authority in charge of the relevant sector, or the funding government agency.
|
|
|
Article 9
|
When the cyber security responsibility levels of each agency conforms to two or above requirements un-der Article 4 to the preceding articles, the levels of such agency are classified as the highest level con-forming to such requirements.
|
|
|
Article 10
|
The cyber security responsibility levels of each agency shall be determined in accordance with the pre-ceding six articles; however, when the government agency submits or approves the cyber security re-sponsibility levels under Paragraphs 1 to 3 of Article 3, the levels of each agency may be adjusted, by taking into consideration the degree of impact of the following matters on national security, social public interests, the security of people’s lives, body, or properties, or the reputation of the government agency:
1. Disruptions or interference with business operations related to diplomacy, national defense, home-land security, or critical infrastructure.
2. Where its business involves personal information, official confidentiality, or other information which should be confidential by law or by contract - the quantity and nature of such information, and the unauthorized access, use, control, breach, damage, tampering, destruction or other in-fringement.
3. Depending on different levels of each agency - the impact on, failure, or interruption of its func-tions.
4. Other concrete matters relating to the provision, maintenance operation, size, or nature of information and communication system.
|
Info
|
|
Article 11
|
Each agency shall conduct the matters specified in Schedule 1 to Schedule 8, depending on its cyber security responsibility levels.
For the information and communication system that is developed by each agency itself or outsourced for the development, each agency shall complete the classification of information and communication sys-tem according to the principles of classification of defense requirements of information and communication system specified in Schedule 9, and shall implement control measures according to the defense standards of information and communication system specified in Schedule 10. When the central competent authority in charge of the relevant sector of a specific non-government agency considers it is neces-sary to otherwise provide for defense standards of specific types of the information and communication systems, it may propose by itself the defense standards and report such standards to the competent authority for approval, and shall follow the requirements of such standards, where approved.
Government agencies with approval from their superior or supervisory agencies may apply the defense standards and related regulations established by the central competent authority in charge of the relevant sector as set forth in the preceding paragraph; the same applies to other specific non-government agen-cies that have obtained approval from their respective central competent authority in charge of the rele-vant sector.
In conducting the matters specified in Schedule 1 to Schedule 8 or implementing control measures speci-fied in Schedule 10, when each agency has apparent difficulties in conducting or implementing specific matters or control measures due to such factors as technical limitation, design, structure or nature of in-dividual cyber systems, it may, with consent of each agency submitting its levels under the latter part of Paragraph 1 to Paragraph 2 of Article 3 or each agency approving its levels under the former part of Paragraph 1 and Paragraph 3 of the same article, and upon reporting to the competent authority for re-cordation, be exempted from the implementation of such matters or control measures. Where the agency submits its levels falls under the aforementioned circumstances, it may be exempted from implementation with the consent of the competent authority. When an agency approves the levels, exemption from implementation may be granted after notifying the competent authority for recordation.
The government agency shall report the implementation status of matters under Paragraph 1 and Paragraph 2 in the manner designated by the competent authority.
The central competent authority in charge of the relevant sector may require the specific non-government agency regulated under their charge to report the implementation status of matters under Paragraph 1 and Paragraph 2 in the manner designated.
Pursuant to the provisions of Schedules 1 to 10, agencies required to add or modify items as a result of amendments shall complete such actions within the specified timeframe, with the deadline commencing from the effective date of the amendments.
|
Info
|
|
Article 12
|
The implementation date of these Regulations shall be stipulated by the competent authority.
The amendments to these Regulations shall come into effect on the date of promulgation.
|
|