Taiwan Cybersecurity Management Act: Regulations, Compliance Requirements, Enterprise Guide

"Does our company need to comply with the Cybersecurity Management Act?"

This is a common question from many enterprise executives. The cybersecurity law sounds distant, but it may be more relevant than you think.

This article explains the Cybersecurity Management Act in plain language.

After reading, you'll know: what the law regulates, who must comply, what actions are required, and what happens if you don't comply.

What is the Cybersecurity Management Act?

The Cybersecurity Management Act (資通安全管理法) was promulgated in June 2018 and took effect in January 2019.

Legislative Background

Why do we need a cybersecurity law?

Frequent Security Incidents

In recent years, government agencies and critical infrastructure have been frequently attacked.

• Government websites hacked
• Critical infrastructure attacked
• Mass personal data breaches

Without legal regulations, each agency acted independently, resulting in uneven protection.

International Trends

Countries worldwide have successively enacted cybersecurity regulations:

• EU NIS Directive
• US NIST Framework
• Japan Basic Act on Cybersecurity

Taiwan needed to keep pace.

National Security Considerations

Cybersecurity is part of national security. It requires law-level regulations.

Goals of the Cybersecurity Management Act

Simply put, the act aims to achieve three things:

1. Establish cybersecurity responsibility system: Who is responsible for what
2. Standardize security protection standards: What level of protection is required
3. Implement incident reporting mechanisms: How to handle incidents

Who Must Comply with the Cybersecurity Management Act?

The act regulates two categories:

Government Agencies

• Central government ministries
• Local governments
• Public schools
• State-owned enterprises

Specific Non-Government Agencies

• Critical infrastructure providers
• State-owned enterprises
• Government-funded foundations

"Specific Non-Government Agencies" is the key point. It extends the act's scope to the private sector.

Core Content of the Cybersecurity Management Act

The act has 23 articles. Main content is as follows:

Chapter 1: General Provisions (Articles 1-4)

Legislative Purpose

To actively promote national cybersecurity policies, accelerate the construction of the national cybersecurity environment, to protect national security and maintain public interest.

Definitions

• Cybersecurity: Preventing information systems or data from unauthorized access, use, control, disclosure, damage, alteration, destruction, or other infringement
• Information System: Systems used to collect, control, transmit, store, circulate, delete information, or otherwise process, use, or share information

Competent Authority

The Executive Yuan is the competent authority (now executed by the Administration for Cyber Security under the Ministry of Digital Affairs).

Chapter 2: Government Agency Security Management (Articles 5-9)

Chief Information Security Officer System

Each agency shall appoint a Chief Information Security Officer (CISO), to be held by the agency head or deputy head.

The CISO is responsible for:

• Promoting agency security policies
• Coordinating resource allocation
• Supervising security measures

Security Responsibility Levels

Government agencies are classified into levels A, B, C, D, and E based on business importance.

Higher levels have stricter security requirements.

Security Plans and Audits

Each agency must:

• Establish cybersecurity maintenance plans
• Assign dedicated security personnel
• Undergo regular audits

Chapter 3: Specific Non-Government Agency Security Management (Articles 10-15)

Designation and Announcement

Central competent authorities designate and announce specific non-government agencies.

In other words, you must be "designated" to be classified as a specific non-government agency.

Critical Infrastructure

The law specifically emphasizes "critical infrastructure providers," including:

• Energy (electricity, oil and gas)
• Water resources
• Communications
• Transportation
• Banking and finance
• Emergency services and hospitals
• Government agencies
• Science parks and industrial zones

Major operators in these sectors are likely to be designated as specific non-government agencies.

Required Actions

Specific non-government agencies shall:

• Establish security maintenance plans
• Assign dedicated security personnel
• Submit implementation status reports to competent authorities
• Cooperate with audits

Chapter 4: Incident Reporting and Response (Articles 16-18)

Reporting Obligations

When aware of a security incident, reports must be made within specified timeframes.

Reporting recipients:

• Government agencies: Report to supervisory agencies and competent authorities
• Specific non-government agencies: Report to central competent authorities

Reporting Deadlines

Different reporting deadlines apply based on incident severity (detailed below).

Chapter 5: Penalties (Articles 19-21)

Violation Penalties

• Failure to establish maintenance plan: NT$300,000-5,000,000
• Failure to report as required: NT$300,000-5,000,000
• Serious violations: Up to NT$5,000,000

Deadline for Improvement

Failure to improve after notification may result in consecutive penalties.

Security Responsibility Levels Explained

One of the most important concepts in the Cybersecurity Management Act is "responsibility levels."

Government Agency Levels

Level	Applicable Agencies	Dedicated Personnel	Audit Frequency
A	Central ministries, municipality governments	4+ persons	Annual
B	County/city governments, central subordinate agencies	2+ persons	Every 2 years
C	Township offices	1+ persons	Every 3 years
D	General government agencies	Part-time acceptable	Every 4 years
E	Simple operations agencies	Part-time acceptable	As needed

Specific Non-Government Agency Levels

Specific non-government agencies are also classified into levels A, B, and C:

Level	Applicable Organizations	Dedicated Personnel
A	Most critical infrastructure	4+ persons
B	Important critical infrastructure	2+ persons
C	General specific non-government agencies	1+ persons

Requirements by Level

Level A

Most stringent requirements:

• Implement security management system (e.g., ISO 27001)
• Annual security audits
• Establish 24/7 security monitoring
• Conduct penetration testing
• Participate in security exercises

Level B

• Establish security policies
• Security audit every 2 years
• Conduct vulnerability scanning
• Establish incident reporting procedures

Level C

• Basic security measures
• Security audit every 3 years
• Security awareness training

Unsure if your enterprise complies with the Cybersecurity Management Act? Compliance requirements are complex, and missing items may result in penalties. Schedule Compliance Consultation, let us help you identify gaps.

Enterprise Compliance Checklist

If you are a specific non-government agency, you need to do these things:

Organization and Personnel

Assign Dedicated Security Personnel

Assign dedicated personnel based on level.

Note:

• Must have formal position appointment
• Must attend security professional training
• Recommend obtaining security certifications

Establish Security Organization

• Designate CISO (recommend senior executive)
• Form security promotion team
• Clarify security responsibilities of each department

Policies and Plans

Establish Security Policy

Including:

• Security objectives
• Scope
• Management principles
• Violation handling

Establish Security Maintenance Plan

Detailed implementation plan including:

• Risk assessment methods
• Security controls
• Monitoring and audit methods
• Continuous improvement mechanisms

Technical Measures

Basic Protection

• Firewall configuration
• Antivirus deployment
• Access control
• Log recording

Advanced Protection (Levels A and B)

• Intrusion detection systems
• Vulnerability scanning
• Penetration testing
• SOC monitoring

Management Measures

Asset Inventory

Inventory all information assets:

• Hardware equipment
• Software systems
• Data
• Network architecture

Risk Assessment

Assess risks for each asset:

• Threat sources
• Vulnerability analysis
• Impact level
• Risk level

Access Control

Establish account and password management:

• Least privilege principle
• Regular permission reviews
• Password policies
• Disable accounts upon departure

Outsourcing Management

If you outsource IT:

• Include security clauses in contracts
• Supervise vendor security
• Manage outsourced personnel

Training

General Employees

Annual security awareness training, including:

• Password security
• Phishing email identification
• Social engineering prevention
• Data protection

Security Personnel

Professional training, including:

• Security technical courses
• Certification acquisition
• Conference participation

Audit and Improvement

Internal Audit

Regular self-checks:

• Policy implementation status
• Control measure effectiveness
• Personnel compliance

External Audit

Accept audits from competent authorities or authorized organizations based on level.

Continuous Improvement

Deficiencies found in audits should:

• Develop improvement plans
• Track improvement progress
• Verify improvement effectiveness

Enforcement Rules Key Points

The enforcement rules provide more specific regulations.

Security Maintenance Plan Content

The enforcement rules specify that maintenance plans should include:

1. Core business and its importance
2. Cybersecurity policies and objectives
3. Security promotion organization
4. Dedicated personnel allocation
5. Information system inventory and classification
6. Cybersecurity risk assessment
7. Security protection and control measures
8. Security incident reporting and response mechanisms
9. Security intelligence assessment and response
10. Security audit mechanisms
11. Outsourced system or service management
12. Business continuity planning

Security Incident Levels

The enforcement rules classify security incidents into four levels:

Level	Definition	Reporting Deadline
Level 1	Non-core systems affected	Within 72 hours
Level 2	Core systems affected but operational	Within 36 hours
Level 3	Core systems unable to operate	Within 24 hours
Level 4	Affects other agencies or public	Within 1 hour

Audit Items

Audits will check:

• Security organization operations
• Personnel training records
• Risk assessment reports
• Control measure implementation
• Incident handling records
• Audit improvement tracking

For detailed reporting procedures, see Security Incident Reporting Guide.

Recent Amendments

The Cybersecurity Management Act continues to be updated. Here are recent important changes.

2021 Amendments

Main changes:

1. Strengthened reporting obligations: Shortened reporting deadlines
2. Expanded scope: Included more specific non-government agencies
3. Increased penalties: Raised maximum fines

2023-2024 Updates

Ministry of Digital Affairs Established

The Ministry of Digital Affairs was established in 2022, with the Administration for Cyber Security responsible for act enforcement.

Critical Infrastructure Protection Act

Under consideration, may:

• Expand critical infrastructure scope
• Strengthen cross-sector coordination
• Increase violation penalties

Supply Chain Security

Increasing attention to supply chain security:

• Software supply chain security
• Hardware trustworthiness
• Outsourced service management

Trend Observations

Possible future directions:

1. Expand regulatory scope: Include more enterprises
2. Increase penalties: Deterrent effect
3. Cybersecurity insurance: May require coverage
4. International alignment: Integration with international standards

Enterprise Compliance Recommendations

Whether or not you're designated as a specific non-government agency, security compliance is worth attention.

Self-Assessment

First assess your current situation:

1. Are you a specific non-government agency?

Check:

• Whether designated by competent authority
• Whether you're critical infrastructure
• Whether you're a state-owned enterprise or government-funded foundation

2. What is your responsibility level?

The competent authority will inform you. If unsure, proactively ask.

3. Do existing measures meet requirements?

Compare against the compliance checklist to identify gaps.

Compliance Path

Starting Phase

1. Designate security responsible person
2. Inventory existing security measures
3. Identify major gaps
4. Develop improvement plan

Implementation Phase

1. Establish security policies
2. Build management systems
3. Deploy technical measures
4. Implement training

Operations Phase

1. Execute daily monitoring
2. Handle security incidents
3. Regular audit reviews
4. Continuous improvement

Common Gaps

Common enterprise compliance gaps:

Organizational

• No formally designated dedicated security personnel
• Security personnel without professional training
• No clear security organizational structure

Policy

• No written security policy
• Outdated policies not updated
• Employees unaware of policy content

Technical

• No complete asset inventory
• Incomplete protection measures
• Insufficient log retention

Management

• No regular risk assessments
• Poor outsourcing management
• Superficial audits

Resource Investment Estimates

Compliance requires resource investment. Rough estimates:

Personnel

Level	Dedicated Personnel	External Support
Level A	4+ people	Consultants, auditors
Level B	2+ people	Auditors
Level C	1+ people	As needed

Budget

Level	Annual Budget Estimate
Level A	$150,000+ USD
Level B	$50,000-100,000 USD
Level C	$15,000-30,000 USD

This includes personnel, equipment, and external services.

Seeking Assistance

You don't have to do it all yourself. External support is available:

Consulting Services

• System implementation guidance
• Policy document writing
• Compliance gap analysis

Technical Services

• Vulnerability scanning
• Penetration testing
• SOC monitoring

Audit Services

• Internal audits
• Pre-audit preparation

FAQ

Do general enterprises need to comply with the Cybersecurity Management Act?

The Cybersecurity Management Act directly regulates "government agencies" and "specific non-government agencies."

General enterprises not designated don't directly fall under the act.

However, if you're a government agency supplier, contracts may require you to meet certain security standards.

Additionally, the Personal Data Protection Act, financial regulations, and other laws also have security requirements.

How do I know if I'm a specific non-government agency?

Central competent authorities will announce it.

For example:

• Financial industry by Financial Supervisory Commission
• Telecommunications industry by NCC
• Energy industry by Ministry of Economic Affairs

If unsure, ask the competent authority.

What's the relationship between the Cybersecurity Management Act and ISO 27001?

The Cybersecurity Management Act is law; ISO 27001 is an international standard.

They overlap but are not identical.

Level A agencies are usually required to implement ISO 27001.

Organizations with ISO 27001 certification will find compliance easier, but still need to compare against the act's specific requirements.

What happens if you violate the Cybersecurity Management Act?

Administrative Penalties

• Failure to establish maintenance plan: NT$300,000-5,000,000
• Failure to report as required: NT$300,000-5,000,000
• Consecutive penalties possible

Other Consequences

• Agency/enterprise reputation damage
• May face enhanced audits
• Responsible persons may be disciplined

Must security incidents be reported?

Specific non-government agencies experiencing security incidents must report by law.

The purpose of reporting isn't punishment, but:

• Coordination and handling
• Preventing spread
• Providing support
• Accumulating experience

Concealment discovered later results in heavier penalties.

What qualifications do dedicated security personnel need?

Regulations don't mandate specific certifications.

But recommendations include:

• Attend security professional training
• Obtain professional certifications (CEH, CISSP, etc.)
• Continuous education

Next Steps

After understanding the Cybersecurity Management Act, here's what to do:

Action Checklist

1. Confirm status: Are you subject to the act?
2. Understand level: What's your responsibility level?
3. Review current status: Do existing measures meet requirements?
4. Plan improvements: Identify gaps, develop plan
5. Seek support: Get external help if needed

Related Resources

Extended reading:

• Information Security Complete Guide: Security basics
• Security Incident Reporting Guide: Detailed reporting procedures
• Security Assessment Guide: Methods to assess current status

---

Need Cybersecurity Management Act compliance assistance?

Compliance requirements are complex, and every enterprise's situation is different.

CloudInsight helps you:

• Assess compliance status
• Identify improvement gaps
• Plan compliance path
• Match professional services

Schedule Consultation, let us help you achieve compliance.