TaiwanCyber Security Incident Reporting, Response and Drills Regulations, Specific Non-Government Agency Clocks
Regulations Governing the Reporting Response and Drills for Cyber Security Incidents (資通安全事件通報應變及演練辦法), full-text amendment issued (Ministry of Digital Affairs Order Shu-Shou-Zi-Fa-Zi No. 1145000415), Arts. 11 and 13
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to a specific non-government agency under the Cyber Security Management Act, meaning a designated critical infrastructure provider, a government-owned enterprise, a designated foundation, or an enterprise, organization or institution under government control; reached by declaring that you operate an essential service.
- Report a cyber security incident in the manner the sector's central competent authority designates within one hour after you become aware of it, and keep updating the report if the incident level changes (Article 11(1) and (2)).
- Complete damage-control or recovery operations and notify the sector authority within 72 hours of becoming aware of a level 1 or level 2 incident, or within 36 hours of becoming aware of a major incident (Article 13(1)).
- Submit an investigation, handling and corrective action report to the sector authority within one month after those operations, unless the authority agrees to extend the time (Article 13(2) and (3)).
- Have your Chief Information Security Officer convene a meeting after you become aware of a major incident (Article 14(3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 29 of the Act sanctions a failure to report an incident with an administrative fine and a correction order; no provision read makes the failure, standing alone, a criminal offense.
Penalty structure
Article 29 of the Act sets a fine of NT$300,000 to NT$10,000,000 for failing to report an incident under Article 24(2), with additional fines for each violation left uncorrected past the ordered deadline.
- Rule
- Fixed only
- As of
- Currency
- TWD
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
The central competent authority in charge of the relevant sector, which receives the reports and imposes the fine, with the Ministry of Digital Affairs as the competent authority.
Settledness
- As of
- Open questions
- Does the Article 29 fine for failing to report under Article 24(2) also reach a missed 72-hour, 36-hour or one-month deadline in Article 13 of the Regulations?
What this law does
The Regulations are prescribed under Article 24(4) of the Cyber Security Management Act, among other provisions of that Act. Article 24(4) of the Act leaves the necessary items of the reporting and response mechanism, the reporting content and the submission of reports to rules the competent authority prescribes. Article 11(1) of the Regulations requires a specific non-government agency to report a cyber security incident within one hour after becoming aware of it.
Article 13(1) of the Regulations requires a specific non-government agency to complete damage-control or recovery operations within 72 hours of becoming aware of a level 1 or level 2 incident and within 36 hours of becoming aware of a major incident. Article 13(2) of the Regulations requires the agency to submit an investigation, handling and corrective action report within one month after those operations.
The Act defines a specific non-government agency as a critical infrastructure provider, a government-owned enterprise, a designated foundation, or any enterprise, organization or institution under control of the government. Article 29 of the Act punishes a specific non-government agency that fails to report an incident under Article 24(2) with a fine of NT$300,000 to NT$10,000,000. The full-text amendment of took effect on the date of its issuance.
When LexLint raises it
When your app profile says your app runs an essential service.