Regulations Governing the Standards for Information System and Security Management of Electronic Payment Institutions Article 11

The information security policy, internal organization and asset management of an electronic payment institution shall meet the following requirements:1. The information security policy should be adopted by resolution of the board of directors, the board of managing directors, or approved by managerial officer authorized by the board. For branches of foreign banks in Taiwan, the information security policy shall be signed off by their responsible officer.2. The information security policy mentioned in the preceding subparagraph shall be published and conveyed to all employees and external stakeholders.3. The electronic payment institution should establish information operation related managements and operating rules.4. The information security policy mentioned in Subparagraph 1 hereof and management and operating rules mentioned in the preceding subparagraph shall be reviewed and revised every year, and examined when there are material changes (e.g. newly promulgated law or regulations) to ensure their ongoing suitability, adequacy and effectiveness.5. The electronic payment institution should, in accordance with the operating procedure of e-payment platform, identify assets, including personnel, forms, equipment, software and systems, and establish a list of assets, operating procedures, network architecture, organizational chart and responsible persons, and take inventory periodically to maintain their accuracy.6. The electronic payment institution should define the roles and responsibilities of personnel and segregate conflicting roles.7. The electronic payment institution should, based on operational risk and professional capability, select suitable personnel to serve in their positions and provide them with necessary training regularly.