|
Article 24
|
The securities firm shall adopt procedures for handling information security incidents. The procedures shall at least include incident confirmation and troubleshooting mechanisms, incident reporting mechanisms, emergency response mechanisms, occasions for suspension of trading and the handling thereof, compensation measures with respect to the rights and interests of investors, and procedures for handling resumption of trading. The securities firm furthermore shall be diligent about effectively preserving a trail log and evidence, and set up business continuity management mechanisms.
When there occurs any incident of irregularity in information services, or any cyber security incidents, that materially affects customer rights or interests or normal operation, the securities firm shall make a preliminary notification through the Cyber Security Notification System for Securities and Futures Industry within 30 minutes after the incident takes place , and shall make a formal notification and an incident resolution notification, respectively, at the time the incident has been investigated and understood and after the handling of the incident is finished.
When trading is suspended because of an information security incident, the securities firm shall wait until after the incident has been resolved and it has taken preventive and corrective measures before it may resume trading. However, if trading is suspended twice or more within half a year, an incident evaluation and correction report shall be issued by a CPA, to confirm that the preventive and corrective measures taken can effectively prevent recurrence of incidents of the same kind, and the report shall be filed with the TPEx before the resumption of trading.
|