LexLint.ioBeta

Know the law your code answers to.

Law / Taiwan

Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management

Arts. 3(6)-(8) 7-8, 20-23 and 30 of the Cyber Security Management Act (資通安全管理法), full-text amendment promulgated (Presidential Order Hua-Zong-Yi-Yi-Zi No. 11400095391), effective

In force since .

A sector security regimes rule binding private bodies.

Obligation class
Security, Governance

What it requires

  • This binds a critical infrastructure provider the government has individually designated under Article 20, or another specific non-government agency (a government-owned enterprise, a designated nationwide foundation, or an enterprise, organization or institution under government control) Article 3(6) defines; a business the competent authority has not placed in one of these designated classes carries no duty under this row.
  • Report to the competent authority for approval or recordation of the agency's assigned cyber security responsibility level, based on the sensitivity, volume and nature of the information the agency holds and the scale and nature of its information and communication systems.NIST CSF 2.0GV.OC-03NIST CSF 2.0ID.AM-05
  • Appoint a dedicated Chief Information Security Officer to promote and oversee the agency's cyber security affairs.NIST CSF 2.0GV.RR-02
  • Formulate, revise and implement a cyber security maintenance plan matching the agency's assigned responsibility level, and submit its implementation status and any corrective-action report to the central competent authority in charge of the relevant sector.NIST CSF 2.0GV.PO-01
  • Comply with the central competent authority's periodic or ad hoc audits of the maintenance plan's implementation; a designated critical infrastructure provider's audit results are forwarded to the Ministry of Digital Affairs.NIST CSF 2.0GV.OC-03
  • A failure to formulate, implement or report on the plan draws a fine of NT$100,000 to NT$5,000,000 per violation, after an unheeded order to correct within a specified period.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST CSF 2.0
  • GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
  • GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
  • GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on the mission
CIS Controls
  • 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 1.2Roles, responsibilities and authorities
  • 2.2Compliance monitoring
  • 3.2Monitoring and logging
  • 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

Article 30's sanction for a maintenance-plan, reporting or audit failure is an administrative fine with an order to correct; no provision reviewed here makes that failure, standing alone, a criminal offense.

Penalty structure

Article 30's shared range for any of six listed failures (maintenance-plan formulation or implementation, implementation-status reporting, corrective-action reporting, notification-mechanism formulation, incident-report submission, and drill or notification-content requirements) is NT$100,000 to NT$5,000,000 per violation, imposed after an order to correct within a specified period goes unheeded, escalating per violation for continued non-correction.

Rule
Fixed only
As of
Currency
TWD
Fixed cap
5,000,000

Who enforces it

Enforcement body

The central competent authority in charge of the relevant sector for a designated critical infrastructure provider or other specific non-government agency (for example the Financial Supervisory Commission for a financial-sector critical infrastructure provider), which reports audit and corrective-action results to the Ministry of Digital Affairs, the Act's overall competent authority.

Settledness

As of
Open questions
The Cyber Security Management Act's own enforcement rules (資通安全管理法施行細則, pcode A0030303) were confirmed by name to exist during this research pass; does their substantive content add a threshold, timeline or procedure to the responsibility-level or audit duties recorded here?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Chapter III of the Cyber Security Management Act binds a 'Specific Non-Government Agency,' defined to mean 'a critical infrastructure provider, a government-owned enterprise, a designated foundation, or any enterprise, organization, or institution under control of the government' (Art. 3(6)).

A critical infrastructure provider's own class is defined by reference to 'physical or virtual assets, systems, or networks, the functions of which, once they cease to operate or their performance is reduced, may have a significant impact on national security, social and public interests, people's lives, or economic activities' (Art. 3(7)), a class the Executive Yuan periodically designates.

A critical infrastructure provider 'shall comply with the requirements of their assigned cyber security responsibility levels, appoint dedicated cyber security personnel, and ... formulate, revise, and implement cyber security maintenance plans' (Art. 20, Paragraph 2). Every other specific non-government agency carries the identical duty under Article 21, Paragraph 1.

Every specific non-government agency must also 'appoint a Chief Information Security Officer ... responsible for promoting and overseeing the specific non-government agency's cyber security-related affairs' (Art. 23). A failure to formulate, implement or report on the maintenance plan draws, under Article 30, 'a fine of not less than NT$100,000 and not more than NT$5,000,000 ... for each violation.'

When LexLint raises it

When your app profile says your app runs an essential service.

Back to the example  ·  Lint your app

Page updated .