載入中
Enforcement Rules of the Cyber Security Management Act
1.中華民國一百零七年十一月二十一日行政院院臺護字第 1070213547 號 令訂定發布全文 13 條；施行日期，由主管機關定之 中華民國一百零七年十二月五日行政院院臺護字第 1070217128 號令發 布定自一百零八年一月一日施行 2.中華民國一百十年八月二十三日行政院院臺護字第 1100182012 號令修 正發布第 6、7、13 條條文；並自發布日施行 中華民國一百十一年八月二十四日行政院院臺規字第 1110184307 號公 告第 3 條、第 11 條第 1 項、第 12 條、第 13 條第 1 項所列屬 「行政院」之權責事項，自一百十一年八月二十七日起改由「數位發展 部」管轄 3.中華民國一百十五年一月五日數位發展部數授資法字第 1145000413 號 令修正發布全文 15 條；並自發布日施行
資料來源：全國法規資料庫（ChOrder.json，版本 2026/7/24 上午 12:00:00）・政府資料開放授權
These Enforcement Rules are prescribed pursuant to Article 34 of the Cyber Security Management Act (hereinafter referred to as the “Act”).
The designated agency for cyber security referred to in Paragraph 2, Article 2 of the Act is the Administration for Cyber Security, Ministry of Digital Affairs.
As referred to in Subparagraph 5, Article 3 of the Act, “military agencies” refer to the Ministry of National Defense and its subordinate agencies (institutions), units, and schools; “intelligence agencies” refer to the agencies specified in Subparagraph 1, Paragraph 1 and Paragraph 2, Article 3 of the National Intelligence Work Act.
Before designating enterprises, organizations, or institutions controlled by the government pursuant to Subparagraph 10, Article 3 of the Act, the central competent authority in charge of the relevant sector shall provide them with an opportunity to present their views. The same requirement applies to the designation of critical infrastructure providers under Paragraph 1, Article 20 of the Act.
1A “major cyber security incident” as defined in Subparagraph 5, Paragraph 1, Article 4 of the Act refers to an incident involving a private sector entity that meets one of the following criteria and poses a significant risk to social public interest, people’s daily lives, or economic activity, while also drawing substantial public attention:
21. Serious disclosure of core business information.
32. Serious tampering with core business information or core information and communication systems.
43. The operation of core information and communication systems is affected or interrupted, and cannot be restored to normal operation within the tolerable interruption time.
1When government agencies or specific non-government agencies (hereinafter referred to as “agencies”) submit a corrective action report in accordance with Paragraph 2, Article 8; Paragraph 1, Article 16; Paragraph 5, Article 20; or Paragraph 3, Article 21 of the Act, they shall present the following information based on the audit findings regarding the implementation of their cyber security maintenance plans:
21. Items and content found deficient or requiring improvement.
32. Cause(s) of occurrence.
43. Measures implemented across management, technical, human resources, or other resource dimen sions to correct deficiencies or strengthen areas requiring improvement.
54. The scheduled completion timeline for the aforementioned measures in the preceding subparagraph and the methods for tracking implementation progress.
6Following submission of the corrective action report as stipulated in the preceding paragraph, agencies shall submit a report on the implementation status of the corrective action report within the timeframe and according to the procedures designated by the auditing agency.
1When agencies outsource the establishment, maintenance, or operation of information and communication systems, or the provision of information and communication services in accordance with Article 10 of the Act (hereinafter referred to as “outsourced services”), they shall pay attention to the following matters when selecting and supervising contractors:
21. The contractor shall be equipped with sufficient cyber security personnel who have undergone ap propriate qualification training, hold cyber security professional certifications, or possess equivalent professional experience in related service areas.
32. Whether the outsourced services may be further subcontracted, the permissible scope of and coun terparties for such subcontracting, and the cyber security maintenance measures to be adopted by subcontractors.
43. Personnel executing outsourced services that involve classified national security information shall undergo suitability reviews and be subject to exit restrictions in compliance with the Classified National Security Information Protection Act.
54. For outsourced services containing customized information and communication system development, the contractor must provide security testing certification. When the information and commu nication system is classified as a core information and communication system of the contracting agency or the contract value exceeds NT$10 million, the agency shall either perform its own security testing or engage a third party to conduct it. Where the use of systems or resources not developed by the contractor is involved, the non-self-developed content and its source shall be marked, and proof of authorization shall be provided.
6
The third-party assistance mechanism as referred to in Paragraph 4, Article 10 of the Act refers to an impartial and professional institution that is independent from the competent authority, and the government agencies and specific non-government agencies participating in the drills.
1The cyber security maintenance plans specified in Article 13; Paragraph 2, Article 20; and Paragraph 1, Article 21 of the Act shall include the following items:
21. Core businesses and their significance.
32. Cyber security policies and goals.
43. Cyber security promotion organization.
54. Allocation of full-time staff and funding.
65. Appointment of a Chief Information Security Officer.
76. Inventory of information and communication systems and designation of core information and com munication systems and related assets.
87. Cyber security risk management.
98. Cyber security protection and control measures.
109. The reporting, response, and drill mechanisms for cyber security incidents.
1The scope of core businesses referred to in the Subparagraph 1, Paragraph 1 of the preceding article shall be as follows:
21. For government agencies, business that can be reasonably determined as falling within their coreresponsibilities and authority based on their organizational regulations.
32. Business necessary for each agency to operate, maintain, or provide critical infrastructure.
43. The primary services or functions of public enterprises, specific foundations, and government-con trolled enterprises, organizations, or institutions.
54. Business operations of agencies involving the matters specified in Subparagraphs 1 to 5, Article 4, or Subparagraphs 1 to 5, Article 5 of the Regulations on Classification of Cyber Security Responsibility Levels.
6The core information and communication system referred to in Subparagraph 6, Paragraph 1 of the preceding article refers to a system necessary to support the continuity of core business operations, or any system determined to have a high required defense level according to the provisions of Appendix 9, Principles for Classifying Protection Requirement Levels for Information and Communication Systems, of the Regulations Governing the Classification of Cyber Security Responsibility Levels.
1With respect to the superior agency as defined in Article 14 of the Act, the following shall apply at the central agency level:
21. Secondary agencies and independent agencies under the Office of the President and the Executive Yuan and secondary agencies under the Examination Yuan and the Control Yuan are, respectively, under the jurisdiction of the Office of the President, the Executive Yuan, the Examination Yuan, and the Control Yuan.
32. Agencies at the third level and below under the Executive Yuan, Examination Yuan, and Control Yuan are under the jurisdiction of the second-level agencies within their respective jurisdictions.
43. The courts directly under the Judicial Yuan and the Judges Academy are under the jurisdiction of the Judicial Yuan. The various branch courts, district courts, and the Taiwan Kaohsiung Juvenile and Family Court under the Taiwan High Court are under the jurisdiction of the Taiwan High Court. The local courts under the Fuchien High Court Kinmen Branch Court are under the jurisdiction of the Fuchien High Court Kinmen Branch Court.
1The investigation, handling, and corrective action report regarding cyber security incidents, as specified in Paragraph 3, Article 17 and Paragraph 3, Article 24 of the Act, shall include the following items:
21. The time of incident occurrence or discovery and the completion time of damage control and recovery operations.
32. Assessment of the incident’s impact scope and damage.
43. The progression of damage control and recovery operations.
54. The progression of incident investigation and handling procedures.
65. Root cause analysis of the incident.
76. Measures implemented across management, technical, human resources, or other resource dimen sions to prevent the recurrence of similar incidents.
87. The scheduled completion timeline for the aforementioned measures in the preceding subparagraph and the performance tracking mechanism.
The term “major cyber security incident” referred to in Paragraph 5, Article 17; Paragraph 2, Article 18; Paragraphs 3 and 5, Article 24; and Paragraphs 1 and 2, Article 25 of the Act refers to level 3 and level 4 cyber security incidents as defined in Paragraphs 4 and 5, Article 2 of the Regulations Governing the Reporting, Response and Drills for Cyber Security Incidents.
1When the competent authority, the agency receiving reports on the implementation of cyber security maintenance plans as specified in Article 14 of this Act, or the central competent authority in charge of the relevant sector becomes aware of a major cyber security incident and announces the necessary contents and response measures related to the incident pursuant to Paragraph 5, Article 17 and Paragraph 5, Article 24 of this Act, it shall specify the time of occurrence or discovery of the incident, its cause, the extent of impact, the control status, and subsequent improvement measures.
2Where the necessary content and response measures related to the incident in the preceding paragraph fall under any of the following circumstances, they shall not be publicly announced:
31. The information involving trade secrets or relating to business operations of an individual, juristic person, or group, the disclosure of which might infringe upon the rights or other legitimate interests of the government agency, individual, juristic person, or group, unless it is otherwise provided by law, necessary for the public interest or for the protection of the lives, bodies, or health of the people, or with the consent of the parties involved.
42. Other circumstances where the information shall be kept confidential, or its disclosure restricted or prohibited, pursuant to laws and regulations.
5Where the necessary content and response measures related to the incidents in Paragraph 1 contain information that falls under the non-disclosure circumstances described in the preceding paragraph, only the remaining parts may be publicly announced.
These Enforcement Rules shall come into effect on the date of promulgation.
76. Ensuring that upon termination or dissolution of the outsourcing relationship, the contractor returns, transfers, deletes, or destroys all data held in the course of contract performance.
87. Other cyber security and maintenance measures to be implemented by the contractor.
98. The contracting agency shall periodically, or upon learning of any cyber security incidents that may impact the outsourced services, verify the execution of such operations through audits or other suitable methods.
10When conducting suitability reviews for Subparagraph 3 of the preceding paragraph, the contracting agency shall consider the classification level and content of classified national security information involved in the outsourced services. Within the necessary scope, it shall verify whether personnel of the contractor responsible for executing such business and other personnel who may have access to the classified national security information have any of the following circumstances:
111. Persons who have been convicted by a final judgment of any offense under the Chapter of Offenses Against Computer Security of the Criminal Code, or who are currently wanted in unresolved cases related to such offenses.
122. Persons who have been convicted of Offenses of Disclosure of Secrets, or who, after the end of the period of national mobilization for suppression of communist rebellion, committed Offenses Against the Internal Security of the State or Offenses Against the External Security of the State, and have been convicted by a final judgment or are currently wanted in unresolved cases.
133. Persons who were previously employed as civil servants and received a disciplinary sanction or an administrative action of a demerit or heavier for violating relevant security and confidentiality regulations.
144. Persons who have been induced or coerced by a foreign government or authorities from Mainland Area, Hong Kong, or Macau to carry out actions that harm national security or the country's significant interests.
155. Other specific matters related to the protection of classified national security information.
16Circumstances as described in Subparagraph 3, Paragraph 1 shall be documented in the tender announcement, tender documents, and contract. Prior to conducting suitability reviews, written consent from the persons concerned is also required.
1110. Mechanisms for assessing and responding to cyber security information.
1211. Management measures for outsourced information and communication systems or services.
1312. Performance evaluation mechanism for personnel whose duties involve cyber security matters.
1413. Continuous improvement of cyber security maintenance plans and implementation status and per formance management mechanisms.
15Agencies shall include the execution results and relevant explanations of each subparagraph mentioned above when submitting reports on the implementation status of their cyber security maintenance plans as required under Article 14; Paragraph 3, Article 20; or Paragraph 2, Article 21 of the Act.
16The formulation, revision, and implementation of cyber security maintenance plans referred to in Paragraph 1, as well as the submission of the implementation status referred to in the preceding paragraph, may be carried out by the receiving agency, its subordinate or supervised government agencies, or the following entities under its jurisdiction: township (town, city) offices, district offices of indigenous dis-tricts in special municipalities, township (town, city) representative councils, and representative councils of indigenous districts in special municipalities, provided that the government agency obtains the consent of the agency that receives the implementation status of its cyber security maintenance plan pursuant to Article 14 of the Act. For a specific non-government agency, the matters referred to in the preceding paragraph may, subject to the consent of its central competent authority in charge of the relevant sector, be carried out by such central competent authority, or the subordinate or supervised government agencies or specific non-government agencies under the jurisdiction of such central competent authority.