TaiwanTelecommunications Management Act, Cyber Security and Critical Infrastructure Protection Plans
Arts. 15 42, 76 and 79 of the Telecommunications Management Act (電信管理法), enacted , effective for the provisions cited here
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds a telecommunications enterprise that has established a public switched telecommunications network (PSTN) using allocated telecommunications resources, or another telecommunications enterprise the competent authority separately announces is bound; an enterprise the competent authority has not so designated, and that has not established such a network, carries no duty under this row.
- Draw up an info-communications security maintenance plan covering the management scope and classification of covered systems, compliance-verification measures, plan-implementation measures, and joint-defense and incident-response measures, and implement it.NIST CSF 2.0GV.PO-01
- Where the competent authority designates the enterprise's PSTN, in whole or in part, as critical telecommunications infrastructure, additionally draw up a critical telecommunications infrastructure protection plan before the competent authority's own deadline, submit it for the competent authority's evaluation before implementing it, and comply with the technical specifications for info-communications security evaluation the competent authority sets for that infrastructure.NIST CSF 2.0GV.PO-01NIST CSF 2.0GV.OC-03
- The Ministry of Digital Affairs, not the National Communications Commission, has held the competent-authority role over both duties since .
- Failing to draw up or implement the general maintenance plan draws a fine of NT$100,000 to NT$1,000,000; failing to submit or implement an approved critical-infrastructure protection plan draws a separate fine of NT$200,000 to NT$2,000,000; both escalate for continued non-correction.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Articles 76 and 79 punish a maintenance-plan or protection-plan failure with an administrative fine and a correction order; no provision reviewed here makes either failure, standing alone, a criminal offense.
Penalty structure
Two separate tiers share this instrument. Article 79's range for failing to draw up or implement the general Article 15 info-communications security maintenance plan is NT$100,000 to NT$1,000,000. Article 76's range for failing to submit or implement an approved Article 42 critical telecommunications infrastructure protection plan is NT$200,000 to NT$2,000,000, the higher figure recorded as this field's cap; both ranges are imposed after a correction order, and escalate, or in Article 76's case may instead revoke the network-establishment approval, for continued non-correction.
- Rule
- Fixed only
- As of
- Currency
- TWD
- Fixed cap
- 2,000,000
Who enforces it
Enforcement body
The Ministry of Digital Affairs, which took over the National Communications Commission's competent-authority role over Article 15 and Article 42 on .
Settledness
- As of
- Open questions
- Which government-designated PSTN operators are currently subject to the Article 42 critical-telecommunications-infrastructure designation, and has that designation list, or the technical specifications for info-communications security evaluation it triggers, been published?
What this law does
Article 15 of the Telecommunications Management Act requires that 'Telecommunications enterprises who have established a PSTN using telecommunications resources or other telecommunications enterprises announced by the competent authority shall draw up an info-communications security maintenance plan and implement it accordingly'.
Separately, Article 42 lets the competent authority 'designate the PSTN, in whole or in part, as the critical telecommunications infrastructure,' whose establisher 'shall ... draw up a critical telecommunications infrastructure protection plan' subject to the competent authority's evaluation. Failing the general maintenance-plan duty draws a fine under Article 79 for 'Violating Paragraph 1 of Article 15, where no info-communications security management plan has been drawn up or implemented,'.
Failing the critical-infrastructure protection-plan duty draws a separate, higher fine under Article 76 for a party who 'fails to submit critical telecommunications infrastructure protection plan to the competent authority for approval within the prescribed deadline or fails to implement the approved plan.'
When LexLint raises it
When your app profile says your app runs an essential service or provides telecom services.
Back to the example · Lint your app
Page updated .