• Font Size：
  • S
  • M
  • L

Amendments

Title：

Establishing Information Security Inspection Mechanisms for Securities Firms  CH

Amended Date： 2024.11.12 (Articles 2, 9 amended,English version coming soon)
Current English version amended on 2023.08.23 
Categories： Market Supervision > Regulation of Securities Firms
Article Content Content Search Article No. Search Amended Article Legislative History Chinese

Title： Establishing Information Security Inspection Mechanisms for Securities Firms(2021.11.18)
Date：
3     Security Organization (CC-13000, annual audit)
  1. The company shall follow the requirements to have appropriate human resources and equipment available for planning and monitoring of the information security system and implementing the information security management operation. The job responsibilities of the relevant staff and their other concurrent responsibilities shall be in compliance with regulations.
  2. The company shall designate a vice president or high level supervisor to take overall charge of affairs pertaining to the promotion of information security policies and allocation of resources and, where necessary, may also establish an interdepartmental "Information Security Task Force." If the company satisfies certain conditions prescribed by the competent authority, it shall designate a person of or above the rank of vice president or with comparable functions to act concurrently as a chief information security officer to handle the aforementioned business.
  3. As necessary for the purposes of information security management and according to its information security level, the company shall specifically assign personnel or unit(s) to be responsible for planning and implementing information security work, and the assigned information security staff and the assigned supervisor(s) shall attend regular information security professional programs and trainings of at least 15 hours and pass the assessment in year. Other staff with access to information system shall attend information security awareness promotion programs of at least three hours in a year.
  4. If the company lacks sufficient information security manpower, skills, or experience, it may retain external scholars, experts, or professional private institutions and groups to provide information security consulting services.
  5. The authority and duties of the company's information processing department shall be clearly differentiated from those of its business units.
  6. The company shall request its assigned information security personnel to receive and maintain such information security professional license adequate to its information security level. (To become effective by end of January 2023.)
7     Management of Communications and Operations (CC-17000)
  1. Management of network security (CC-17010, applicable to securities firms placing orders via the Internet; items a, b and e are applicable to all securities firms, subject to monthly audit):
    1. Evaluating the security of network systems:
      1. The company shall regularly evaluate the security of its own network systems (e.g., its operating system, network servers, browsers, firewall, and anti-virus software) and retain related records.
      2. Security gaps in the network operating environment and operating system (including servers, portables, personal terminals, and computers available on business premises to investors for shared use) shall be repaired regularly or timely. The related documentation shall be retained.
      3. Matters bearing on computer network security (including the promotion of awareness of the information security policy, prevention of hacking, and anti-virus measures) shall be internally announced at any time and from time to time.
      4. A specially appointed employee shall be designated to be responsible for computer servers and important software and hardware.
      5. The company’s network shall be categorized, according to purpose of use, as DMZ, operating environment, testing environment and other environment, and there shall be an appropriate division mechanism between these environments (e.g. firewall, virtual local area network, and physical separation).
      6. Personal information and confidential and sensitive information shall be stored in a secured network area, and shall not be stored on the Internet or other non-secured areas.
      7. Only necessary services and programs may be available in the system, and unused services and functions should be made unavailable.
      8. The company shall establish the guidelines for remote connection management to control the internal operation within the organization through remote connection via the external network, keep the relevant maintenance records to be regularly reviewed by the proper supervisor.
      9. The company shall prevent use of the internal network from an unauthorized device.
    2. Managing firewall security:
      1. A firewall shall be established.
      2. A specially appointed employee shall be responsible for managing the firewall.
      3. Records of firewall entries, exits, and backup copies shall be retained for at least three years.
      4. Important website and server systems (e.g. online order placing systems) shall be isolated from the Internet by the firewall.
      5. The firewall system configuration shall be approved by the proper supervisor.
      6. The company shall regularly examine and maintain the setup of control of access to firewall on a yearly basis and keep the relevant examination records.
      7. No products that may jeopardize the national information security may be used on the equipment directly connecting to the networks used for the company’s transactions.
    3. Managing network transmission and connection security:
      1. Online order placing pages shall be protected by encryption (e.g. SSL).
      2. The company shall monitor and analyze on a daily basis records of log-in failures in connection with core system accounts and attempts to log in to non-customer accounts etc., and retain the relevant records.
      3. When providing online order service, the company shall, upon login to place an order, implement multi-factor authentication, e.g., order certification, device identifier, OTP, biometric system etc.), to ensure login by the customer itself.
    4. Managing CA authentication and certificates:
      1. A securities firm placing orders online shall adopt certificate delivery procedures to prevent certificates from being obtained by persons other than their intended owners.
      2. A securities firm placing orders online shall use an authentication system for all orders.
    5. Protecting against computer viruses and malicious software:
      1. Anti-virus software shall be installed. Its programs and virus definitions shall be given timely updates.
      2. Computer systems and data storage media (including emails) shall be regularly scanned for viruses.
      3. Anti-virus protection shall cover personal terminals (including portables and computers available on business premises to investors for shared use) and network servers.
      4. Emails from unknown sources shall not be opened. Special care shall be used in opening emails with attachments containing executable files.
      5. To prevent computer viruses from spreading and affecting computer security, the company shall adopt security rules governing email use and establish an email filter system.
      6. The company shall have online use control measures in place to prevent download of malware.
      7. The company shall detect links that connect to phishing websites and malicious websites and remind clients to be cautious about online phishing.
      8. The company is advised to conduct regular social engineering exercises on a yearly basis, and provide coaching to personnel who have opened an email or clicked a link they have been advised against opening or clicking, and keep relevant records.
    6. Inspecting the functions of online ordering systems:
      1. The functions provided by online ordering systems shall be inspected regularly and inspection records shall be kept.
      2. To monitor, record and notify changes to web pages and programs enabling online ordering systems to the related staff.
    7. Regulations governing the company's provision of API services:
      The application procedure, approval standards and relevant control measures and operations in regard to the company's provision of API services to customers are governed by the Directions for the Provision of Application Programming Interface (API) Service by Securities Firms to Customers
    8. Quality standards for services for placing orders via the Internet:
      When providing services for placing orders via the Internet, the company needs to maintain the quality of customer services by establishing quality standards for placing orders via the Internet, which shall cover the key elements such as transaction security, stability and system availability, and customer services.
    9. Introduction of cyber-attack prevention system and security tests:
      1. The company shall perform infiltration tests on the core system that provides the Internet services regularly according to its information security level, and make improvements based on the test results. (To become effective by end of January 2022.)
      2. The company shall conduct regular information and communication security checkups according to its information security level, which should include inspection of network structure, inspection of malicious cyber activities, inspection of malicious activities at a user’s computer, inspection of malicious activities at the server, setup of directory server, and inspection of setup of firewall connection. (To become effective by end of January 2023.)
      3. The company shall establish an information and communication security threat detection management system according to its information security level, which should include collection of events, analysis of irregularities, detection of attacks, and determination of attack acts. (To become effective by end of January 2023.)
      4. The company shall establish an invasion detection and prevention system according to its information security level. (To become effective by end of January 2023.)
      5. The company shall set up firewalls for its applications according to its information security level. (To become effective by end of January 2023.)
      6. The company shall implement advanced prevention measures against continuous threats and attacks according to its information security level. (To become effective by end of January 2023.)
  2. Computer system and operation safety management (CC-17020, semi-annual audit)
    1. Managing computer equipment:
      The company shall enter into a written maintenance agreement with the maintenance service provider to establish the content of computer equipment maintenance work. A maintenance log shall be retained after the completion of maintenance. The information unit shall appoint personnel to conduct inspection together with the maintenance personnel from the maintenance service provider.
    2. Environment configuration and use authorization settings of the operating systems of computers:
      1. The environment configuration and use authorization settings of the operating systems of computers shall be approved by the relevant supervisor and implemented by system administrators.
      2. Appropriate backup measures shall be in place with respect to files in the computer system before and after they are modified.
      3. The company shall establish the guidelines for management of accounts with the highest system authorization level, covering both operating system and application system, and the approval of the proper supervisor is required for use of an account with the highest authorization level, and relevant records shall be retained.
      4. The company shall create and diligently implement the security configuration basis for personal computers, servers and network communication devices (e.g. length of a password, and how frequently a password may be changed).
      5. The company shall adopt a multiple-factor authentication method when using the administrator’s account to log in an important system via the Internet.
    3. Security management of computer media:
      1. Backup copies of important software, related documents, and inventory lists shall be made and stored in a separate safe location.
      2. If important backup files and software are stored in the same building that houses the computer center, they shall be kept locked in a fireproof room or in a cabinet that is both fireproof and earthquake-proof.
      3. Storage media used for backup materials shall be labeled with the name of the materials and their retention period.
      4. Handling procedures shall be established for media used to store confidential and sensitive information so as to prevent leaking or improper use of the information.
      5. To build a testing mechanism for data saving to verify integrity of backups and environmental suitability.
    4. Management of computer operation:
      1. Computer operators shall strictly adhere to prescribed operating procedures.
      2. Complete and accurate records shall be provided in an operating log, which shall be inspected and approved daily by a supervisor. The operator and the supervisor may not be the same person.
      3. Specially appointed personnel shall be responsible for inspecting information in the logs of the system console and for regularly submitting the information to a supervisor for inspection and approval.
    5. The securities broker shall have a computer system that has adequate capacity and is capable of meeting the needs of its business.
    6. The securities broker shall adopt mechanisms and procedures for regular evaluations (at least once a year) of the capacity of and security measures for its computer system, to be carried out either internally or outsourced to a professional institution. The system capacity shall be stress-tested regularly and records of the testing retained.
10     Business Continuity Management (CC-20000, semi-annual audit)
  1. Failure recovery procedures (e.g. backup and recovery plans for computer equipment, communications equipment, power systems, databases, and computer operating systems etc.) shall be clearly formulated and implemented, and records shall be made.
  2. Failure recovery procedures shall be tested periodically; after testing, a review meeting shall be convened to consider ways to improve in response to deficiencies and a record thereof shall be retained.
  3. Securities brokers shall have backup measures in place for their trading servers.
  4. The company shall formulate a business continuity plan (covering such matters as activation conditions, participating personnel, emergency response procedures, backup procedures, maintenance schedules, education and training, descriptions of job duties, response plans of outside entities with which the company does business, and contract suitability), maintain measures necessary for the plan, and to prescribe the key operations and related impact analyses, followed by business continuity operation exercise, that will take place regularly, according to its information security level. (To become effective by end of January 2022.)
  5. The company shall adopt an information security reporting mechanism (e.g. formal reporting procedures and appointed contacts for information security incident reports). In the event of information security and service irregularities relating to information systems, the company shall apply the Operational Guidelines on Reporting of Information and Communication Security Related Events in Securities and Futures Markets, take appropriate corrective procedures, and retain related records.
  6. Any theft, alteration, damage, loss or divulgence of, or other information security incident involving, personal information shall be immediately reported by the company to the TWSE (TPEx or Taiwan Securities Association) in writing, to be advised to the competent authority.
  7. The company shall establish clear operational procedures to defend and respond to distributed denial-of-service attack (DDoS).