Law / Taiwan

Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit

Arts. 24-25 of the Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries… (金融控股公司及銀行業內部控制及稽核制度實施辦法), full-text revision promulgated May 6, 2026 (Financial Supervisory Commission Order Jin-Guan-Yin-Guo-Zi No. 11502710961), effective on promulgation for the articles cited here

In force since 6 May 2026.

A sector security regimes rule binding private bodies.

Obligation class

Security, Governance, Reporting

What it requires

• This binds a financial holding company or a banking-industry entity (a bank, credit cooperative, bills finance company or trust enterprise) under Financial Supervisory Commission jurisdiction; an entity outside that class carries no duty under this row.
• Establish a dedicated information security unit reporting to the general manager, that does not also handle information-technology operations or any other function creating a conflict of interest, staffed with adequate personnel and equipment.NIST CSF 2.0GV.RR-02
• Appoint a deputy general manager or equivalent as Chief Information Security Officer over that unit, and have that officer report the prior year's overall information-security performance to the board of directors annually and report a material information-security problem promptly when it arises.NIST CSF 2.0GV.RR-02NIST CSF 2.0GV.RR-01
• Have the dedicated unit plan, manage and execute the information security system to control information security risk, supervise every unit's compliance with it, and build the mechanisms for cyber security protection, threat-intelligence assessment, and cyber security incident notification and response.NIST CSF 2.0GV.RR-02NIST CSF 2.0ID.IM-04
• Provide the dedicated unit's personnel at least 15 hours, and other information-technology personnel at least 6 hours, of information-security training annually.NIST CSF 2.0PR.AT-02

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework

• PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.

NIST CSF 2.0

• GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
• GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
• ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
• PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind

CIS Controls

• 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
• 3.10Encryption of sensitive data as it crosses networks.
• 3.11Encryption of sensitive data where it is stored on servers and applications.
• 6.8Access rights defined by job role, and kept up to date.
• 7.1A documented, reviewed approach to finding and handling weaknesses.
• 8.2Turning on and gathering logs from the enterprise's systems.

1 more

• 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.

FINOS AIGF

• AIR-PREV-005System Acceptance Testing
• AIR-PREV-006Data Quality & Classification/Sensitivity
• AIR-PREV-007Legal and Contractual Frameworks for AI Systems
• AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
• AIR-PREV-012Role-Based Access Control for AI Data
• AIR-PREV-014Encryption of AI Data at Rest

7 more

• AIR-PREV-017AI Firewall Implementation and Management
• AIR-PREV-020MCP Server Security Governance
• AIR-PREV-024Human-in-the-Loop Action Approval Gate
• AIR-DET-001AI Data Leakage Prevention and Detection
• AIR-DET-004AI System Observability
• AIR-DET-011Human Feedback Loop for AI Systems
• AIR-DET-021Agent Decision Audit and Explainability

ENISA NIS2 guidance

• 1.1Policy on the security of network and information systems
• 1.2Roles, responsibilities and authorities
• 2.1Risk management framework
• 2.2Compliance monitoring
• 3.1Incident handling policy
• 3.2Monitoring and logging

11 more

• 3.4Event assessment and classification
• 3.5Incident response
• 3.6Post-incident reviews
• 4.1Business continuity and disaster recovery plan
• 4.3Crisis management
• 6.2Secure development life cycle
• 6.5Security testing
• 6.10Vulnerability handling and disclosure
• 9.1Cryptography
• 11.2Management of access rights
• 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Who enforces it

When LexLint raises it

When your app profile says your app runs an essential service or is a bank.

Back to the example  ·  Lint your app

Page updated 19 September 2026.