Regulations Governing the Classification of Cyber Security Responsibility Levels Article 4
Where an agency falls under any of the following circumstances, its cyber security responsibility level shall be Level A:1. Its business involves national secrets;2. Its business involves matters of foreign affairs, national defense, or homeland security;3. Its business involves the maintenance and operation of information and communication systems for nationwide public services, or information and communication systems commonly used across government agencies;4. Its business involves the possession of personal information files of the public nationwide or of public officials;5. It is a government agency and its business involves matters of nationwide critical infrastructure;6. It is a critical infrastructure provider, and the central competent authority in charge of the relevant sector, taking into account the number of users, market share, geographic scope, and substitutability of the critical infrastructure services they provide or maintain and operate, deems that failure of or impact on their information and communication systems would have catastrophic or severe adverse effects on social and public interests, public morale, or the life, body, or property of the people; or7. It is a public medical center.
中文原文 資通安全責任等級分級辦法第4條
各機關有下列情形之一者，其資通安全責任等級為A級：
一、業務涉及國家機密。
二、業務涉及外交、國防或國土安全事項。
三、業務涉及全國性民眾服務或跨公務機關共用性資通系統之維運。
四、業務涉及全國性民眾或公務員個人資料檔案之持有。
五、屬公務機關，且業務涉及全國性之關鍵基礎設施事項。
六、屬關鍵基礎設施提供者，且業務經中央目的事業主管機關考量其提供或維運關鍵基礎設施服務之用戶數、市場占有率、區域、可替代性，認其資通系統失效或受影響，對社會公共利益、民心士氣或民眾生命、身體、財產安全將產生災難性或非常嚴重之影響。
七、屬公立醫學中心。
一、業務涉及國家機密。
二、業務涉及外交、國防或國土安全事項。
三、業務涉及全國性民眾服務或跨公務機關共用性資通系統之維運。
四、業務涉及全國性民眾或公務員個人資料檔案之持有。
五、屬公務機關，且業務涉及全國性之關鍵基礎設施事項。
六、屬關鍵基礎設施提供者，且業務經中央目的事業主管機關考量其提供或維運關鍵基礎設施服務之用戶數、市場占有率、區域、可替代性，認其資通系統失效或受影響，對社會公共利益、民心士氣或民眾生命、身體、財產安全將產生災難性或非常嚴重之影響。
七、屬公立醫學中心。