關鍵電信基礎設施指定及防護管理辦法

These Regulations are enacted in accordance with the provisions of Paragraphs 1 and 5 of Article 42 of the Telecommunications Management Act and shall apply to stations set up by radio and television business operators.

1The establisher of PSTN (hereinafter referred to as the establisher) shall, within the prescribed period and in the prescribed manner notified by the competent authority, conduct an inventory check and self-evaluation. After completion of the inventory check and self-evaluation of various telecommunication infrastructures of PSTN, the establisher shall submit the information to the competent authority.

2Should the outcomes of inventory check and self-evaluation in the preceding paragraph be deemed incomplete, the establisher shall be notified by the competent authority to undertake corrective action within the prescribed period.

3The prescribed period in the first paragraph shall not be shorter than 2 months.

1In order to review the outcomes of inventory check and self-evaluation in accordance with the preceding article, the competent authority may consult with the relevant public agencies, civil society organization, experts and scholars, and may designate all or part of the public telecommunications network as primary, secondary or tertiary critical telecommunications infrastructure prior to submitting to the Executive Yuan for approval.

2The designation in the preceding paragraph shall consider factors with regard to PSTN, including the functional importance, service regions, substitutability, and disruptive impact among others.

1The establisher shall, within three months after being notified of the designation results by the competent authority, formulate its critical telecommunications infrastructure protection plan in accordance with the template of the Critical Telecommunications Infrastructure Security Protection Plan of the Executive Yuan, and submit it to the competent authority for evaluation.

2Should the critical telecommunications infrastructure protection plan submitted by the establisher of critical telecommunications infrastructure (hereinafter referred to as the critical telecommunications infrastructure establisher) be deemed incomplete, the critical telecommunications infrastructure establisher shall be notified by the competent authority to undertake corrective action within the prescribed period.

3The critical telecommunications infrastructure establisher shall implement its critical telecommunications infrastructure security protection plan assessed by the competent authority; any changes to the critical telecommunications infrastructure protection plan shall be reported to the competent authority for reassessment.

The benchmark items used by the competent authority to assess critical telecommunications infrastructure protection plans shall conform to the template of the Critical Telecommunications Infrastructure Security Protection Plan of the Executive Yuan.

1The competent authority may designate the critical telecommunications infrastructure establisher to conduct drills in accordance with its assessed protection plan, and undertake evaluation of the drills.

2Should there be any issues in need of improvement after evaluation of the drills of the preceding paragraph, the critical telecommunications infrastructure establisher shall undertake corrective action within a specific period as notified by the competent authority.

The critical telecommunications infrastructure establisher shall regularly undertake inventory checks and self-evaluation of the various telecommunications infrastructure of their PSTN according to the provisions of Paragraph 1, Article 2 of these Regulations; should there be any change in the results of their inventory and self-evaluation, the from shall be submitted to the competent authority for reference. When necessary, the competent authority may re-assess the critical infrastructure level based on the provisions of Paragraph 1, Article 3 of these Regulations, and designated benchmarks.

These Regulations shall be implemented from the date of promulgation.