Duty LXD-7499
Is a bank, in Taiwan
Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unitsince 5 lines
Arts. 24-25 of the Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries (金融控股公司及銀行業內部控制及稽核制度實施辦法), full-text revision promulgated (Financial Supervisory Commission Order Jin-Guan-Yin-Guo-Zi No. 11502710961), effective on promulgation for the articles cited here · Read the law's page
- This binds a financial holding company or a banking-industry entity (a bank, credit cooperative, bills finance company or trust enterprise) under Financial Supervisory Commission jurisdiction, except that the competent authority's own provisions govern where it has provided otherwise for a credit cooperative or bills finance company, and a Taiwan branch of a foreign bank that operates under its head office system may be exempted from the Article 24 unit and officer requirement (Article 53); an entity outside that class carries no duty under this row.for a financial business
- Establish a dedicated information security unit reporting to the general manager, that does not also handle information-technology operations or any other function creating a conflict of interest, staffed with adequate personnel and equipment.for a financial business
- Appoint a deputy general manager or equivalent as Chief Information Security Officer over that unit, and have that officer report the prior year's overall information-security performance to the board of directors annually and report a material information-security problem promptly when it arises.for a financial business
- Have the dedicated unit plan, manage and execute the information security system to control information security risk, supervise every unit's compliance with it, and build the mechanisms for cyber security protection, threat-intelligence assessment, and cyber security incident notification and response.when it serves a financial business
- Provide the dedicated unit's personnel at least 15 hours, and other information-technology personnel at least 6 hours, of information-security training annually.for a financial business