TaiwanCyber Security Management Act, Cyber Security Incident Reporting
Arts. 24 and 29 of the Cyber Security Management Act (資通安全管理法) full-text amendment promulgated (Presidential Order Hua-Zong-Yi-Yi-Zi No. 11400095391), effective
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Security, Reporting
What it requires
- This binds the same specific non-government agency class as the Act's Chapter III sector-regime duties (a designated critical infrastructure provider, government-owned enterprise, designated nationwide foundation, or government-controlled enterprise); no revenue, user-count or other threshold narrows the class further.
- Establish a notification and response mechanism for a cyber security incident before one occurs.NIST CSF 2.0ID.IM-04
- Notify the central competent authority in charge of the relevant sector as soon as the agency becomes aware of a cyber security incident.NIST CSF 2.0RS.CO-02
- Submit an investigation, handling and corrective-action report on the incident to that authority, and to the Ministry of Digital Affairs as well where the incident is a major one.NIST CSF 2.0RC.RP-06
- A failure to report an incident under this duty draws a fine of NT$300,000 to NT$10,000,000, with additional fines imposed for each period the agency remains uncorrected past the ordered deadline.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
- RS.CO-02Internal and external stakeholders are notified of incidents
- RC.RP-06The end of incident recovery is declared based on criteria, and incident-related documentation is completed
- CIS Controls
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 29's sanction for a failure to report a cyber security incident is an administrative fine with an order to correct; no provision reviewed here makes that failure, standing alone, a criminal offense.
Penalty structure
Article 29's range for a specific non-government agency's failure to report a cyber security incident under Article 24, Paragraph 2 is NT$300,000 to NT$10,000,000, with additional fines imposed if correction is not made within the prescribed period.
- Rule
- Fixed only
- As of
- Currency
- TWD
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
The central competent authority in charge of the relevant sector, which also receives assistance from and may escalate a major incident to the Ministry of Digital Affairs.
Settledness
- As of
- Open questions
- Does the Cyber Security Management Act's enforcement rules (資通安全管理法施行細則, pcode A0030303), confirmed by name but not read in full during this research pass, set a specific reporting clock (a number of hours or days) for Article 24's incident-notification duty, which the Act's own text leaves to rules the competent authority prescribes?
What this law does
Article 24 requires every specific non-government agency to 'establish notification and response mechanisms for cyber security incidents,' and, 'When specific non-government agencies become aware of a cyber security incident, they shall notify the central competent authority in charge of the relevant sector of the incident'.
Failing that notification duty draws, under Article 29, 'a fine of not less than NT$300,000 and not more than NT$10,000,000,' escalating for continued non-correction past the ordered deadline.
When LexLint raises it
When your app profile says your app runs an essential service.
Back to the example · Lint your app
Page updated .