Chapter IV. Mobilization |
| Article 10 | Government agencies shall establish and maintain a roster of cyber security personnel, indicating the expertise and experience available for mobilization, and shall submit it for recordation in the manner specified by the competent authority; where any change occurs in the roster, the government agency shall notify the competent authority for updating. |
|
| Article 11 | Mobilization shall be activated under the following circumstances:
1. When an agency experiencing a major cyber security incident (hereinafter referred to as the "affected agency") submits a support request in the manner specified by the competent authority because of urgent response needs.
2. When the competent authority determines that mobilization is necessary for a major cyber security incident. |
|
| Article 12 | Mobilization includes damage control during incidents and other aspects of response to cyber security incidents. |
|
| Article 13 | The competent authority may consider the following factors when deciding whether to mobilize:
1. The scale, nature, and geographic scope of the cyber security incident, as well as the degree of urgency for the required emergency response.
2. The allocation of cyber security personnel and their availability for mobilization across the affected agency itself, its affiliated agencies, supervised agencies, agencies under its jurisdiction, superior government agency, and the supervising agency or central competent authority in charge of the relevant sector.
3. The allocation of cyber security personnel and their availability for mobilization of the agency where mobilized cyber security personnel belongs (hereinafter referred to as the “supporting agency”).
4. Other relevant factors.
Where necessary for making the aforementioned decision, the competent authority may require the affected agency to provide explanations, cooperate, or submit relevant documents and supporting information. |
|
| Article 14 | When the competent authority activates mobilization, it shall first consult the affected agency and the supporting agency.
Supporting agencies shall follow and carry out orders from the competent authority. |
|
| Article 15 | When the competent authority activates mobilization, it must provide written notice to both the supporting agency and the affected agency.
When notice cannot be given using the method described in the preceding paragraph for any reason, it may be sent by other appropriate means, and the required notification shall be provided afterwards in the prescribed manner.
The notice referred to in Paragraph 1 must include the following items:
1. The affected agency and the supporting agency.
2. Mobilization period and location.
3. Support needs and precautions.
4. Contact details for the competent authority, the affected agency, and the supporting agency.
5. Roster of support personnel.
6. Other precautions.
Each mobilization period shall not exceed seven days. Where the competent authority finds it necessary, it may grant one extension, but the extension may not exceed seven days. |
|
| Article 16 | Personnel involved in mobilization must cooperate with the competent authority to document emergency response actions, improvement recommendations, and other related matters. |
|
| Article 17 | Personnel involved in mobilization who, during the mobilization period, learn confidential and sensitive information of government or specific non-government agencies are required to keep that information confidential. |
|