公眾電信網路檢驗辦法

These Regulations are enacted in accordance with the provisions of Paragraph 3, Article 43 of the Telecommunications Management Act（hereinafter referred to as the Act）.

Public telecommunications network inspection is divided into network performance inspection and info-communications security inspection.

The network performance and info-communications security inspection object shall refer to the public telecommunications network establisher（hereinafter referred to as the establisher）.

1The competent authority shall select more than six examination-compliant establishers each year to conduct network performance inspections.

2The competent authority shall consider the criticality, scale, number of subscribers, type of telecommunications service, frequency and extent of major telecommunications equipment or line incidents, frequency and results of the inspection, and other factors related to network performance when conducting the periodic inspections prescribed in the preceding paragraph.

3When the competent authority conducts network performance inspection, it shall act in accordance with the principle of not obstructing telecommunications services.

1When the competent authority conducts the periodic inspection mentioned in the preceding article, it shall notify the inspected establisher（hereinafter referred to as the inspected entity）of the inspection date, inspection items, sampling quantity of inspection, compliance standards, self-assessment document format, and payment notice in writing two months in advance. The inspected entity shall complete the payment within the time limit specified in the notice sent by the competent authority.

2If the inspected entity in the preceding paragraph fails to cooperate with the inspection at the time designated by the competent authority due to business factors or other legitimate reasons, it may apply to the competent authority to change the inspection date with a written statement of reasons within five days from the next day after receiving the notice prescribed in the preceding paragraph.

3The application in the preceding paragraph shall be limited to one change only, except for reasons of force majeure.

1After receiving the notice in the preceding article, the inspected entity shall submit self-assessment and supporting materials within the time limit stated in the notice.

2If the self-assessment and supporting materials mentioned in the preceding paragraph are deemed incomplete, the competent authority may notify the inspected entity to undertake corrective action within a prescribed period of time or determine it to be non-compliance.

3The inspected entity shall assign an engineering supervisor to participate in the inspection throughout the entire process, and assign more than one staff member to assist in the inspection.

1If the establisher falls under any one of the following circumstances, the competent authority may conduct irregular network performance inspections of the establisher, and the inspection items shall be related to major telecommunications equipment or line incidents in principle：

21. Major telecommunications equipment or line incidents occurred in public telecommunications networks

32. Other circumstances announced by the competent authority

1The inspection items, test methods and compliance standards of the network performance inspection shall be managed in accordance with the examination regulations of the Technical Specifications for Examination of Public Telecommunications Network, Technical Specifications for Microwave Radio Station, Technical Specifications for Satellite Earth Radio Station, Technical Specifications for Radio Broadcast Stations, and Technical Specifications for TV Broadcast Stations.

2Sampling quantity of inspection and compliance standards shall be in accordance with the technical specifications listed in the preceding paragraph, and shall be one-tenth of the normal sampling quantity in principle, unless the competent authority is conducting irregular network performance inspections in accordance with Article 7.

1The competent authority shall notify the inspected entity of the inspection results within one month after the completion of the network performance inspection.

2If the inspection results in the preceding paragraph show deficiencies or improvement is needed, the inspected entity shall submit an improvement report to the competent authority within one month after receiving the inspection results.

3After the inspected entity submits an improvement report prescribed in the preceding paragraph, within the time specified by the competent authority, according to the nature and extent of the deficiencies or items needing improvement, the implementation of the improvement report shall be submitted in writing; if deemed necessary by the competent authority, the competent authority may request the inspected entity to explain or undertake improvements.

1The competent authority shall select more than six examination-compliant establishers each year to conduct information security inspections.

2The competent authority shall consider the criticality, scale, number of subscribers, type of telecommunications service, level of info-communications security responsibility, frequency and extent of info-communications security incidents, frequency and results of the inspection, and other factors related to information security when conducting periodic inspections prescribed in the preceding paragraph.

3When the competent authority conducts network performance inspection, it shall act in accordance with the principle of not obstructing telecommunications services.

1When the competent authority conducts periodic inspections mentioned in the preceding article, it shall notify the inspected entity of the inspection date, inspection items, compliance standards, and payment notice in writing two months in advance. The inspected entity shall complete the payment within the time limit specified in the notice sent by the competent authority.

2If the inspected entity in the preceding paragraph fails to cooperate with the inspection at the time designated by the competent authority due to business factors or other legitimate reasons, it may apply to the competent authority to change the inspection date with a written statement of reasons within five days from receiving the notice prescribed in the preceding paragraph.

3The application in the preceding paragraph shall be limited to one change only, except for reasons of force majeure.

1If the establisher falls under any one of the following circumstances, the competent authority may conduct irregular info-communications security inspections to it：

21. The info-communications security incident occurred on the public telecommunications networks and reached a level-3 cyber security incident or higher as stipulated in the Regulations on the Notification and Response of Cyber Security Incident.

32. There is a likelihood that the public telecommunications network may endanger national security or info-communications security, and it is notified by relevant authorities.

1The content of the info-communications security inspection conducted by the competent authority shall be as follows：

21. For the inspected entity having the information security maintenance plan formulated, the implementation of its information security maintenance plan shall be inspected.

32. For the inspected entity having not formulated the information security maintenance plan, the implementation of its network information security protection planning shall be inspected.

4When a part or all of the public telecommunications network of the inspected entity in the preceding paragraph is critical telecommunications infrastructure, the competent authority may require the inspected entity to provide supporting materials that comply with the Technical Specifications for Info-communications Security Testing of Info-communication Equipment of the Critical Telecommunications Infrastructure whose formulation is authorized by Paragraph 8, Article 42 of the Act.

5If the supporting materials mentioned in the preceding paragraph cannot be provided, the competent authority may request the inspected entity to provide a valid test report issued by a test body recognized by the competent authority to perform the technical specifications prescribed in the preceding paragraph, within the specified period.

6The period prescribed in the preceding paragraph shall be limited to two months.

The items and compliance standards of the info-communications security inspection shall be handled in accordance with the info-communications security inspection form announced by the competent authority.

1The competent authority shall notify the inspected entity of the inspection results within one month after the completion of the info-communications security inspection.

2If the inspection results in the preceding paragraph show deficiencies or improvement needed, the inspected entity shall submit an improvement report to the competent authority within one month after receiving the inspection results.

3After the inspected entity submits an improvement report prescribed in the preceding paragraph, within the time specified by the competent authority, according to the nature and extent of the deficiencies or items needing improvement, the implementation of the improvement report shall be submitted in writing; if deemed necessary by the competent authority, the competent authority may request the inspected entity to explain or undertake improvements.

The second-level central agency commissioned by the competent authority for the execution in accordance with the provisions of Paragraph 2, Article 43 of the Act may conduct info-communications security inspections and network performance inspections in accordance with these Regulations.

The relevant forms and tables stipulated in these Regulations shall be separately announced by the competent authority.

These Regulations shall be implemented from the date of promulgation of the Act.