Regulations Governing the Reporting, Response and Drills for Cyber Security Incidents Article 2
Cyber security incidents are classified into four levels.A cyber security incident occurring at a government agency or a specific non-government agency (hereinafter referred to as an “agency”) under any of the following circumstances is a level 1 cyber security incident:1. Minor disclosure of non-core business information.2. Minor tampering with non-core business information or a non-core information and communication system.3. The operation of a non-core information and communication system is affected or interrupted, but can be restored within the tolerable interruption time, thereby affecting the agency’s routine operations.A cyber security incident occurring at an agency under any of the following circumstances is a level 2 cyber security incident:1. Serious disclosure of non-core business information, or a minor disclosure of core business infor mation not involving the maintenance or operation of critical infrastructure.2. Serious tampering with non-core business information or a non-core information and communication system, or minor tampering with core business information or a core information and commu nication system not involving the maintenance or operation of critical infrastructure.3. The operation of a non-core information and communication system is affected or interrupted and cannot be restored within the tolerable interruption time, or the operation of a core information and communication system not involving the maintenance or operation of critical infrastructure is affected or interrupted but can be restored within the tolerable interruption time.A cyber security incident occurring at an agency under any of the following circumstances is a level 3 cyber security incident:1. Serious disclosure of core business information not involving the maintenance or operation of criti cal infrastructure, or a minor disclosure of confidential information relating to general official affairs or of core business information involving the maintenance or operation of critical infrastructure.2. Serious tampering with core business information or a core information and communication system not involving the maintenance or operation of critical infrastructure, or minor tampering with confidential information relating to general official affairs, core business information, or a core information and communication system involving the maintenance or operation of critical infrastructure.3. The operation of a core information and communication system not involving the maintenance or operation of critical infrastructure is affected or interrupted and cannot be restored within the tolerable interruption time, or the operation of a core information and communication system involving the maintenance or operation of critical infrastructure is affected or interrupted but can be restored within the tolerable interruption time.A cyber security incident occurring at an agency under any of the following circumstances is a level 4 cyber security incident:1. Serious disclosure of confidential information relating to general official affairs, or of core business information involving the maintenance or operation of critical infrastructure, or a disclosure of classified national security information.2. Serious tampering with confidential information relating to general official affairs, core business information, or a core information and communication system involving the maintenance or operation of critical infrastructure, or tampering with classified national security information.3. The operation of a core information and communication system involving the maintenance or oper ation of critical infrastructure is affected or interrupted and cannot be restored within the tolerable interruption time.
中文原文 資通安全事件通報及應變辦法第2條
資通安全事件分為四級。
公務機關或特定非公務機關（以下簡稱各機關）發生資通安全事件，有下列情形之一者，為第一級資通安全事件：
一、非核心業務資訊遭輕微洩漏。
二、非核心業務資訊或非核心資通系統遭輕微竄改。
三、非核心資通系統之運作受影響或停頓，於可容忍中斷時間內回復正常運作，造成機關日常作業影響。
各機關發生資通安全事件，有下列情形之一者，為第二級資通安全事件：
一、非核心業務資訊遭嚴重洩漏，或未涉及關鍵基礎設施維運之核心業務資訊遭輕微洩漏。
二、非核心業務資訊或非核心資通系統遭嚴重竄改，或未涉及關鍵基礎設施維運之核心業務資訊或核心資通系統遭輕微竄改。
三、非核心資通系統之運作受影響或停頓，無法於可容忍中斷時間內回復正常運作，或未涉及關鍵基礎設施維運之核心資通系統之運作受影響或停頓，於可容忍中斷時間內回復正常運作。
各機關發生資通安全事件，有下列情形之一者，為第三級資通安全事件：
一、未涉及關鍵基礎設施維運之核心業務資訊遭嚴重洩漏，或一般公務機密、涉及關鍵基礎設施維運之核心業務資訊遭輕微洩漏。
二、未涉及關鍵基礎設施維運之核心業務資訊或核心資通系統遭嚴重竄改，或一般公務機密、涉及關鍵基礎設施維運之核心業務資訊或核心資通系統遭輕微竄改。
三、未涉及關鍵基礎設施維運之核心資通系統之運作受影響或停頓，無法於可容忍中斷時間內回復正常運作，或涉及關鍵基礎設施維運之核心資通系統之運作受影響或停頓，於可容忍中斷時間內回復正常運作。
各機關發生資通安全事件，有下列情形之一者，為第四級資通安全事件：
一、一般公務機密、涉及關鍵基礎設施維運之核心業務資訊遭嚴重洩漏，或國家機密遭洩漏。
二、一般公務機密、涉及關鍵基礎設施維運之核心業務資訊或核心資通系統遭嚴重竄改，或國家機密遭竄改。
三、涉及關鍵基礎設施維運之核心資通系統之運作受影響或停頓，無法於可容忍中斷時間內回復正常運作。
公務機關或特定非公務機關（以下簡稱各機關）發生資通安全事件，有下列情形之一者，為第一級資通安全事件：
一、非核心業務資訊遭輕微洩漏。
二、非核心業務資訊或非核心資通系統遭輕微竄改。
三、非核心資通系統之運作受影響或停頓，於可容忍中斷時間內回復正常運作，造成機關日常作業影響。
各機關發生資通安全事件，有下列情形之一者，為第二級資通安全事件：
一、非核心業務資訊遭嚴重洩漏，或未涉及關鍵基礎設施維運之核心業務資訊遭輕微洩漏。
二、非核心業務資訊或非核心資通系統遭嚴重竄改，或未涉及關鍵基礎設施維運之核心業務資訊或核心資通系統遭輕微竄改。
三、非核心資通系統之運作受影響或停頓，無法於可容忍中斷時間內回復正常運作，或未涉及關鍵基礎設施維運之核心資通系統之運作受影響或停頓，於可容忍中斷時間內回復正常運作。
各機關發生資通安全事件，有下列情形之一者，為第三級資通安全事件：
一、未涉及關鍵基礎設施維運之核心業務資訊遭嚴重洩漏，或一般公務機密、涉及關鍵基礎設施維運之核心業務資訊遭輕微洩漏。
二、未涉及關鍵基礎設施維運之核心業務資訊或核心資通系統遭嚴重竄改，或一般公務機密、涉及關鍵基礎設施維運之核心業務資訊或核心資通系統遭輕微竄改。
三、未涉及關鍵基礎設施維運之核心資通系統之運作受影響或停頓，無法於可容忍中斷時間內回復正常運作，或涉及關鍵基礎設施維運之核心資通系統之運作受影響或停頓，於可容忍中斷時間內回復正常運作。
各機關發生資通安全事件，有下列情形之一者，為第四級資通安全事件：
一、一般公務機密、涉及關鍵基礎設施維運之核心業務資訊遭嚴重洩漏，或國家機密遭洩漏。
二、一般公務機密、涉及關鍵基礎設施維運之核心業務資訊或核心資通系統遭嚴重竄改，或國家機密遭竄改。
三、涉及關鍵基礎設施維運之核心資通系統之運作受影響或停頓，無法於可容忍中斷時間內回復正常運作。