關鍵電信基礎設施資通設備測試機構及驗證機構管理辦法

These Regulations are promulgated pursuant to Paragraph 2 and 3, Article 87 of the Telecommunications Management Act（hereinafter the “Act”）.

1The terms adopted in these Regulations are defined as follows:

21. Information and communications equipment used by critical telecommunications infrastructure（hereinafter the “Equipment”）: The equipment regulated in Technical Specifications announced by the competent authority in accordance with the Paragraph 8, Article 42 of the Act.

32. Testing Body: The institution that performs testing of the Equipment in accordance with the Technical Specifications described in the preceding subparagraph.

43. Certification Body: The institution commissioned by the competent authority to perform certification of the Equipment.

5The inspection items for the Equipment mentioned in Subparagraph 3 of the previous paragraph shall be announced by the competent authority.

1The Testing Body shall be accredited by the Taiwan Accreditation Foundation（hereinafter the “Accreditation Organization”）and shall be capable of undertaking the tests listed in Technical Specifications announced by the competent authority.

2The Testing Body shall comply with the following requirements:

31. Shall be a domestic legal entity or institution established by law.

42. Compliance with CNS 17025 or ISO/IEC 17025 standards.

53. Shall not be engaged in the input, design, manufacturing or trading of the Equipment to be tested.

64. Include at least three professional and full-time personnel, consisting of one testing supervisor and two testing engineers.

7The personnel mentioned in Subparagraph 4 of the previous paragraph shall comply with the following requirements:

81. The Testing Supervisor shall:

9（1）Possess a bachelor’s degree or above, majoring in information engineering, information management or relevant department from a domestic or foreign public or private college or university recognized by the Ministry of Education.

1In any of the following circumstances, the competent authority may order the Testing Body to undertake corrective action within a prescribed period and suspend its testing work. Testing work shall only be resumed after the completion of the corrective action has been confirmed by the competent authority:

21. Failure to comply with the requirements under Paragraph 2, Article 3.

32. Failure to perform testing work in accordance with the Technical Specifications applicable to the Equipment announced by the competent authority.

43. Refusal to provide relevant documents or refusal of on-site evaluation by the competent authority staff without justification.

54. Breach of CNS17025 or ISO/IEC 17025 standards as determined by the competent authority or Accreditation Organization.

6The suspension period of testing work of the Testing Body in the previous paragraph shall be at least three months. The competent authority may also extend the period to one year depending on the gravity of the situation.

1An applicant to become qualified as a certification body（hereinafter the Applicant）shall be:

21. Domestic legal entity or institution established in accordance with laws.

32. Does not engage in the input, design, manufacturing or trading of the Equipment to be certified.

43. Compliance with CNS 17065 or ISO/IEC 17065 standards.

54. Include at least two full-time certification personnel.

6The certification personnel mentioned in Subparagraph 4 of the previous paragraph shall comply with the following requirements:

71. Possess a bachelor’s degree or above, majoring in information engineering, information management or relevant department from a domestic or foreign public or private college or university recognized by the Ministry of Education.

82. Have at least five years of practical experience in cybersecurity related management or testing evaluation and understanding of regulations and technical specifications.

9

1The Applicant shall submit the following documents with its application to the competent authority:

21. Critical Telecommunications Infrastructure Information and Communications Equipment Certification Body Application Form（as Attachment 1）.

32. Photocopy of corporate or business registration documents.

43. Photocopy of CNS 17065 or ISO/IEC 17065 certificate acquired by the Applicant.

54. Basic information of certification personnel showing compliance with the qualifications as prescribed in Paragraph 2 of the preceding Article.

65. Organization chart and function introduction of the certification department.

76. Quality manual of the certification department.

87. A list of quality documents of the certification department.

98. Inspection procedure for the Equipment to be certified.

10

1Where all documents submitted by the Applicant according to the preceding article are approved, the competent authority will conduct an on-site evaluation.

2The said evaluation shall be conducted according to the following terms and conditions, and an evaluation report shall be provided accordingly:

31. CNS 17065 or ISO/IEC 17065 standards.

42. Technical Specifications applicable to the Equipment announced by the competent authority or national standards.

53. Other matters related to the on-site evaluation requested by the competent authority.

6Where the on-site evaluation results indicate any non-conformity to the preceding paragraph, the competent authority shall list all of them and notify the Applicant to make corrections accordingly. The Applicant shall make corrections and submit an improvement report within the prescribed period. If not, the application will be rejected.

7The period as prescribed in the preceding paragraph shall not exceed three months.

The Applicant shall carry out Equipment inspection work only after it passes the evaluation, signs a commissioned inspection contract for the Equipment with the appraisal（hereinafter the “Commissioned Inspection Contract”）and after the acquires an accreditation certificate for Certification Body of Equipment（hereinafter the “Accreditation Certificate”, as shown in Attachment 2）issued by the competent authority.

1The Certification Body shall not refuse or make discrimination on any of application for Equipment inspection（hereinafter an “Inspection Case”）without justification.

2Certification Bodies and their certification personnel must not engage in any work related to assisting the manufacturer or adjusting the functions of the Equipment.

3The Certification Body shall process Inspection Cases in the name of the Certification Body.

4The testing reports for Inspection Cases under the previous paragraph shall be issued by a Testing Body that has been accredited by the Accreditation Organization.

1The Certification Body shall process the issuance, renewal, reissue, revocation or annulment of of inspection certificates of the Equipment（hereinafter the “Inspection Certificates”）, rejection of inspection application or approval for change of the appearance of the approved Equipment, etc., according to the Technical Specifications for Security Testing of Information and Communication Equipment for Critical Telecommunications Infrastructure.

2All information of each Inspection Case shall be reported to the competent agency within 10 days after the completion of the said work for reference.

3The competent agency shall instruct the Certification Body to sample the Equipment of installers of critical telecommunications infrastructure when necessary. The Certification Body shall report results of all sampling cases to the competent authority within two months after the sampling day.

4The Equipment to be inspected under the previous paragraph shall be provided by the installer of critical telecommunications infrastructure.

1If the Certification Body submits an application to add an inspection item for certification of the Equipment, the application shall be submitted in accordance with Article 6 and the Accreditation Certificate shall be reissued. The validity of the new Accreditation Certificate shall be identical to the original certificate.

2The competent authority may perform an on-site evaluation in accordance with Article 7 when it processes an application under the previous paragraph.

3If there are any changes of the specifications in an Accreditation Certificate, other than adding item mentioned in the first paragraph, an application for reissue of the Accreditation Certificate shall be submitted to the competent authority within 15 days from the date of the change. The validity period of the new Accreditation Certificate shall be identical to the original certificate.

4If any certification personnel of the Certification Body is absent or added, information about the personnel change shall be submitted to the competent authority for reference within 15 days from the date of change.

5The competent authority may order the Certification Body to suspend relevant inspection work when the position of the certification personnel is vacant and leads to non-conformities as described in Subparagraph 4, Paragraph 1, Article 5. The Certification Body shall apply to the competent authority for resuming the conduction of certification by submitting the basic information of the certification personnel after above-mentioned vacancy has been filled.

The competent agency may dispatch personnel to the certification body for irregular inspections and the Certification Body must not refuse it.

1The duration of Commissioned Inspection Contract shall be three years.

2The Certification Body may apply for renewal within two months starting from three months prior to the expiry of the Commissioned Inspection Contract. The competent authority may undertake a review and evaluation as required in accordance with Articles 6 and 7.

3The competent authority shall notify the Certification Body one month prior to the expiry of the Commissioned Inspection Contract that the Certification Body shall no longer accept Inspection Cases. The Certification Body shall complete all accepted Inspection Case within one month from the date of the notification.

1The competent authority may terminate the Commissioned Inspection Contract in any of the following circumstances and order the Certification Body to return and annul its accreditation certificate:

21. Failure to comply with terms and conditions of Paragraph 1, Article 5.

32. Violation of Paragraph 2 of Article 9, Article 10, Article 11 or Article 16.

43. Where the Certification Body performs inspection activities beyond the scope of authority as prescribed in the Commissioned Inspection Contract or shows tardiness to perform the said activities.

54. Where the Certification Body refuses irregular inspections conducted by competent authority without any justifiable reason.

65. Violation of any legislation such as the Act, Administrative Procedure Act, Technical Specifications for Security Testing of Information and Communication Equipment for Critical Telecommunications Infrastructure or the Regulations.

76. Where the Certification Body rejects or makes discrimination on accepted Inspection Case without any justifiable reason.

87. Where the Inspection Certificate issued by the Certification Body contains false or incorrect information.

1When a Commissioned Inspection Contract is terminated in accordance with the previous article, the Certification Body shall forward uncompleted Inspection Cases to the Certification Body designated by the competent authority.

2The Certification Body shall forward complete information related to all Inspection Cases within 7 days from the end of the Commissioned Inspection Contract.

3Certification Body that has the Commissioned Inspection Contract terminated due to circumstances described in the previous article must not become a Certification Body within one year after the termination of the said Contract.

The Certification Body shall establish an online application system within one year from the date of acquisition of the Accreditation Certificate described in Article 8 to accept applications of the inspection of Equipment.

The Certification Body shall charge an inspection fee from the applicant according to charging standards set by the competent authority, and transfer the entire amount to national treasury the next day. The competent authority will pay the outsourcing fee to the Certification Body according to the Commissioned Inspection Contract.

These Regulations shall take effect upon the date of promulgation.