Regulations Governing the Classification of Cyber Security Responsibility Levels Article 3

The Executive Yuan shall, every three years, approve its own cyber security responsibility level and submit it to the competent authority for recordation. Agencies directly under the Executive Yuan shall, every three years, submit the cyber security responsibility levels of their own, their subordinate or supervised government agencies, and the specific non-government agencies under their jurisdiction to the competent authority for approval.Special municipality and county(city) governments shall, every three years, submit the cyber security responsibility levels of their own, their subordinate or supervised government agencies, and the following entities under their jurisdiction: township (town, city) offices, district offices of indigenous districts in special municipalities, township (town, city) representative councils, and representative councils of indigenous districts in special municipalities, as well as the subordinate or supervised government agencies of the foregoing offices and councils, and shall report them to the competent authority for approval. Special municipality and county(city) councils shall, every three years, submit their own cyber security responsibility levels to the competent authority for approval.The Office of the President, the National Security Council, the Legislative Yuan, the Judicial Yuan, the Examination Yuan, and the Control Yuan shall, every three years, approve the cyber security responsibility levels of their own, their subordinate or supervised government agencies, and the specific non-government agencies under their jurisdiction, and submit them to the competent authority for recordation.Where an agency is required to change its original cyber security responsibility level due to organizational or operational adjustments, it shall immediately handle the level change in accordance with the procedures set out in the preceding three paragraphs; the same shall apply where a new agency is established.Where the government agencies under Paragraphs 1 through 3 handle the submission or approval of cyber security responsibility levels and deem it necessary to assign to a unit within a government agency or a specific non-government agency a level different from that of the agency itself, they may determine such level in accordance with Articles 4 through 10, taking into account the nature of the unit's business.