Regulations Governing the Standards for Information System and Security Management of Electronic Payment Institutions Article 12
The management of e-payment platform's system operations/maintenance personnel shall meet the following requirements:1. The electronic payment institution should establish personnel registration, change and registration cancellation procedures for allocating proper access authority.2. The electronic payment institution should examine the reasonableness of the accounts and access authority of operating personnel at least annually and swiftly remove the access authority of personnel who have departed or are transferred to another job to conform to the principles of segregation of duties and internal check.3. Personnel accounts with highest access authority to hardware equipment, application software and system software and accounts that have the authority to change program or parameters should be safekept with a list established; When accounts with highest access authority are used, the consent of the responsible executive must first be obtained and the audit trail shall be retained.4. The electronic payment institution should confirm the identity and access authority of operating personnel, and where necessary, limit the machines and internet protocol (IP) they may use.5. Where a personnel's computer stays idle for more than ten minutes, display of user's personal data on the screen should be restricted.6. When an employee logs in the operating system to make system changes or access the database, related manual operational record should be saved and the password should be changed as soon as possible after use. Where the password cannot be changed for some reason, the electronic payment processing institution should establish monitoring mechanism to avoid unauthorized change and double check the operating record afterwards.7. Employee accounts should be managed by one account per person in principle to avoid one account being shared by multiple persons. If it is necessary to establish a common account, other enhanced control measures should be in place with respect to account application and use with operating records saved and the identity of operators distinguished.8. Where fixed password is used, the password should be changed periodically in accordance with Paragraph 2 of Article 5 herein; the password for accounts provided for use by personnel shall be changed at least once every three months; the password for accounts provided for system connection shall be changed at least once every three months or controlled by other enhanced methods (e.g. restrict manual login).9. Encryption/decryption programs or utility programs with change authority established (e.g. database access program) should be managed with a list established and use restricted. The program should also have access authority set to prevent unauthorized access and have the audit trail retained.
中文原文 電子支付機構資訊系統標準及安全控管作業基準辦法第12條
電子支付平臺之系統維運人員管理應符合下列要求：
一、應建立人員之註冊、異動及撤銷註冊程序，用以配置適當之存取權限。
二、應至少每年定期審查帳號與權限之合理性，人員離職或調職時應盡速移除權限，以符合職務分工與牽制原則。
三、硬體設備、應用軟體、系統軟體之最高權限帳號或具程式異動、參數變更權限之帳號應列冊保管；最高權限帳號使用時須先取得權責主管同意，並保留稽核軌跡。
四、應確認人員之身分與存取權限，必要時得限定其使用之機器與網路位置（IP）。
五、人員超過十分鐘未操作電腦時，應限制使用者個人資料顯示於螢幕。
六、於登入作業系統進行系統異動或資料庫存取時，應留存人為操作紀錄，並於使用後儘速變更密碼；但因故無法變更密碼者，應建立監控機制，避免未授權變更，並於使用後覆核其操作紀錄。
七、帳號應採一人一號管理，避免多人共用同一個帳號為原則，如有共用需求，申請與使用須有其他補強管控方式，並留存操作紀錄且應能區分人員身分。
八、採用固定密碼者，應符合第五條第二項規定，並應定期變更密碼：提供人員使用之帳號至少三個月一次；提供系統連線之帳號，至少每三個月一次或其他補強管控方式（如限制人工登入）。
九、加解密程式或具變更權限之公用程式（如資料庫存取程式）應列冊管理並限制使用，該程式應設定存取權限，防止未授權存取，並保留稽核軌跡。
一、應建立人員之註冊、異動及撤銷註冊程序，用以配置適當之存取權限。
二、應至少每年定期審查帳號與權限之合理性，人員離職或調職時應盡速移除權限，以符合職務分工與牽制原則。
三、硬體設備、應用軟體、系統軟體之最高權限帳號或具程式異動、參數變更權限之帳號應列冊保管；最高權限帳號使用時須先取得權責主管同意，並保留稽核軌跡。
四、應確認人員之身分與存取權限，必要時得限定其使用之機器與網路位置（IP）。
五、人員超過十分鐘未操作電腦時，應限制使用者個人資料顯示於螢幕。
六、於登入作業系統進行系統異動或資料庫存取時，應留存人為操作紀錄，並於使用後儘速變更密碼；但因故無法變更密碼者，應建立監控機制，避免未授權變更，並於使用後覆核其操作紀錄。
七、帳號應採一人一號管理，避免多人共用同一個帳號為原則，如有共用需求，申請與使用須有其他補強管控方式，並留存操作紀錄且應能區分人員身分。
八、採用固定密碼者，應符合第五條第二項規定，並應定期變更密碼：提供人員使用之帳號至少三個月一次；提供系統連線之帳號，至少每三個月一次或其他補強管控方式（如限制人工登入）。
九、加解密程式或具變更權限之公用程式（如資料庫存取程式）應列冊管理並限制使用，該程式應設定存取權限，防止未授權存取，並保留稽核軌跡。