Enforcement Rules of the Cyber Security Management Act Article 9
The cyber security maintenance plans specified in Article 13; Paragraph 2, Article 20; and Paragraph 1, Article 21 of the Act shall include the following items:1. Core businesses and their significance.2. Cyber security policies and goals.3. Cyber security promotion organization.4. Allocation of full-time staff and funding.5. Appointment of a Chief Information Security Officer.6. Inventory of information and communication systems and designation of core information and com munication systems and related assets.7. Cyber security risk management.8. Cyber security protection and control measures.9. The reporting, response, and drill mechanisms for cyber security incidents.10. Mechanisms for assessing and responding to cyber security information.11. Management measures for outsourced information and communication systems or services.12. Performance evaluation mechanism for personnel whose duties involve cyber security matters.13. Continuous improvement of cyber security maintenance plans and implementation status and per formance management mechanisms.Agencies shall include the execution results and relevant explanations of each subparagraph mentioned above when submitting reports on the implementation status of their cyber security maintenance plans as required under Article 14; Paragraph 3, Article 20; or Paragraph 2, Article 21 of the Act.The formulation, revision, and implementation of cyber security maintenance plans referred to in Paragraph 1, as well as the submission of the implementation status referred to in the preceding paragraph, may be carried out by the receiving agency, its subordinate or supervised government agencies, or the following entities under its jurisdiction: township (town, city) offices, district offices of indigenous dis-tricts in special municipalities, township (town, city) representative councils, and representative councils of indigenous districts in special municipalities, provided that the government agency obtains the consent of the agency that receives the implementation status of its cyber security maintenance plan pursuant to Article 14 of the Act. For a specific non-government agency, the matters referred to in the preceding paragraph may, subject to the consent of its central competent authority in charge of the relevant sector, be carried out by such central competent authority, or the subordinate or supervised government agencies or specific non-government agencies under the jurisdiction of such central competent authority.
中文原文 資通安全管理法施行細則第9條
本法第十三條、第二十條第二項及第二十一條第一項所定資通安全維護計畫，應包括下列事項：
一、核心業務及其重要性。
二、資通安全政策及目標。
三、資通安全推動組織。
四、專職人力及經費之配置。
五、資通安全長之配置。
六、資通系統之盤點，並標示核心資通系統及相關資產。
七、資通安全風險管理。
八、資通安全防護及控制措施。
九、資通安全事件通報、應變及演練相關機制。
十、資通安全情資之評估及因應機制。
十一、資通系統或服務委外辦理之管理措施。
十二、所屬人員辦理業務涉及資通安全事項之考核機制。
十三、資通安全維護計畫與實施情形之持續精進及績效管理機制。
各機關依本法第十四條、第二十條第三項或第二十一條第二項規定提出資通安全維護計畫實施情形，應包括前項各款之執行成果及相關說明。
第一項資通安全維護計畫之訂定、修正、實施及前項實施情形之提出，公務機關經本法第十四條規定收受其資通安全維護計畫實施情形之機關同意，得由收受機關或其所屬、所監督之公務機關、所轄鄉（鎮、市）公所、直轄市山地原住民區公所及鄉（鎮、市）民代表會、直轄市山地原住民區民代表會辦理；特定非公務機關經其中央目的事業主管機關同意，得由其中央目的事業主管機關、中央目的事業主管機關所屬、所監督公務機關或中央目的事業主管機關所管特定非公務機關辦理。
一、核心業務及其重要性。
二、資通安全政策及目標。
三、資通安全推動組織。
四、專職人力及經費之配置。
五、資通安全長之配置。
六、資通系統之盤點，並標示核心資通系統及相關資產。
七、資通安全風險管理。
八、資通安全防護及控制措施。
九、資通安全事件通報、應變及演練相關機制。
十、資通安全情資之評估及因應機制。
十一、資通系統或服務委外辦理之管理措施。
十二、所屬人員辦理業務涉及資通安全事項之考核機制。
十三、資通安全維護計畫與實施情形之持續精進及績效管理機制。
各機關依本法第十四條、第二十條第三項或第二十一條第二項規定提出資通安全維護計畫實施情形，應包括前項各款之執行成果及相關說明。
第一項資通安全維護計畫之訂定、修正、實施及前項實施情形之提出，公務機關經本法第十四條規定收受其資通安全維護計畫實施情形之機關同意，得由收受機關或其所屬、所監督之公務機關、所轄鄉（鎮、市）公所、直轄市山地原住民區公所及鄉（鎮、市）民代表會、直轄市山地原住民區民代表會辦理；特定非公務機關經其中央目的事業主管機關同意，得由其中央目的事業主管機關、中央目的事業主管機關所屬、所監督公務機關或中央目的事業主管機關所管特定非公務機關辦理。