|
Article 3
|
(Scope of application for directions on cloud services)
- The scope of application for these directions covers outsourcing of operations involving the business activities stated in the business license or customer information by an organization which involves use of cloud services, in which case the suggestions on management and control under these directions should be complied with.
- An organization whose use of cloud services is not covered by the scope in the preceding paragraph may refer to the control and management requirements under the directions and adopt necessary cloud services information security control and management.
- For operations outsourcing that involves cloud services by the Taiwanese subsidiary or branch of a foreign corporate group, if the outsourcing is handled by its foreign parent company or head office, the management and control measures established by the foreign parent company or head office may be referred to, provided that the requirements shall not be less than those under these directions. The Taiwanese subsidiary or branch of a foreign corporate group shall be required to create an appropriate internal control system and risk management mechanism for its business in Taiwan in full control of the control and management of part of its operation in Taiwan involving cloud service outsourcing.
|