|
Article 11
|
Each agency shall conduct the matters specified in Schedule 1 to Schedule 8, depending on its cyber security responsibility levels.<br/>For the information and communication system that is developed by each agency itself or outsourced for the development, each agency shall complete the classification of information and communication sys-tem according to the principles of classification of defense requirements of information and communication system specified in Schedule 9, and shall implement control measures according to the defense standards of information and communication system specified in Schedule 10. When the central competent authority in charge of the relevant sector of a specific non-government agency considers it is neces-sary to otherwise provide for defense standards of specific types of the information and communication systems, it may propose by itself the defense standards and report such standards to the competent authority for approval, and shall follow the requirements of such standards, where approved.<br/>Government agencies with approval from their superior or supervisory agencies may apply the defense standards and related regulations established by the central competent authority in charge of the relevant sector as set forth in the preceding paragraph; the same applies to other specific non-government agen-cies that have obtained approval from their respective central competent authority in charge of the rele-vant sector.<br/>In conducting the matters specified in Schedule 1 to Schedule 8 or implementing control measures speci-fied in Schedule 10, when each agency has apparent difficulties in conducting or implementing specific matters or control measures due to such factors as technical limitation, design, structure or nature of in-dividual cyber systems, it may, with consent of each agency submitting its levels under the latter part of Paragraph 1 to Paragraph 2 of Article 3 or each agency approving its levels under the former part of Paragraph 1 and Paragraph 3 of the same article, and upon reporting to the competent authority for re-cordation, be exempted from the implementation of such matters or control measures. Where the agency submits its levels falls under the aforementioned circumstances, it may be exempted from implementation with the consent of the competent authority. When an agency approves the levels, exemption from implementation may be granted after notifying the competent authority for recordation.<br/>The government agency shall report the implementation status of matters under Paragraph 1 and Paragraph 2 in the manner designated by the competent authority.<br/>The central competent authority in charge of the relevant sector may require the specific non-government agency regulated under their charge to report the implementation status of matters under Paragraph 1 and Paragraph 2 in the manner designated.<br/>Pursuant to the provisions of Schedules 1 to 10, agencies required to add or modify items as a result of amendments shall complete such actions within the specified timeframe, with the deadline commencing from the effective date of the amendments.
|