|
Article 17
|
(Security Testing)
- An organization shall assess periodically the security of its own network environment, e.g., operating system, server, browser, firewall, and antivirus versions, etc.
- An organization shall remediate security vulnerabilities in the network environment periodically and retain relevant documents.
- A penetration test shall be administered on an annual basis in relation to the information and communication system of a type 1 organization. A type 2 organization shall evaluate whether to administer such periodic test.
- A type 1 organization shall perform an information and communication security health check on an annual basis, including inspection of the network infrastructure, malicious cyber activity, malicious activity of the user computer, malicious activity of the hosting server, directory server settings, and firewall connection settings. A type 2 organization shall evaluate whether to perform such periodic check.
|