Cyber Security Management Act Article 17

Government agencies shall establish a reporting and response mechanism to address cyber security incidents.When government agencies become aware of a cyber security incident, they shall report such an incident to both the agency designated under Article 14 to receive its implementation status report and the competent authority.The government agency shall submit, to the notified agency provided in the preceding paragraph, an investigation, handling, and corrective action report regarding the cyber security incident.The rules regarding the necessary items of the reporting and response mechanisms provided in the preceding three paragraphs, the reporting content, the submission of reports, the conduct of drills, and other related matters shall be prescribed by the competent authority.Where the agency notified under Paragraph 2 becomes aware of a major cyber security incident, it may provide relevant assistance to the government agency concerned, and, when appropriate, may announce the necessary information and corresponding countermeasures relating to the incident.