Regulations Governing the Standards for Information System and Security Management of Electronic Payment Institutions Article 15
The physical security of e-payment platform shall meet the following requirements:1. The computer facilities and the disaster recovery site should avoid being simultaneously situated on fault zone, coastlines, slopes, below sea level, underneath airport flight paths, landslide-prone areas, 100 year flood zones, nuclear emergency alert areas, or high-risk areas in the workplace, and there should be protective measures in place to prevent damages to the computer facilities and disaster recovery site in case of earthquake, tsunami, flood, fire or other natural or manmade disasters.2. Operating equipment should be centrally located in the computer facilities with access control established to ensure that only authorized personnel are allowed to enter and exit the room. The entries and exits of non-authorized personnel should be logged and under the accompaniment and supervision of internal personnel. The entry/exit records should be examined regularly with proper actions taken if any abnormality is found.3. The computer facilities and the disaster recovery site should have 24-hour monitoring equipment set up that does not have monitoring dead angles.4. There should be measures that ensure sufficient supplies of electricity, water and oils for operations that when the supply is interrupted, the operations may be maintained for at least 72 hours. The system should also be connected with at least two telecom service providers that provide Internet service or two offsite lines for backup.5. Oil sump storage and fire safety shall meet the relevant regulatory requirements.6. There should be environment monitoring and control mechanism in place for the management of telecommunication, air conditioning, power, fire safety, access control, surveillance and temperature and humidity of the computer facilities that also sends out warning and notice automatically.7. The control room for management of the computer facilities should have an operating environment comparable to the computer facilities or be equipped with independently control personnel operating the systems and equipment.The control room mentioned in Subparagraph 7 of the preceding paragraph shall meet the following requirements:1. The control room should have access control and be equipped with monitoring equipment with connection and usage logs retained and audit carried out regularly.2. Only authorized system operations/maintenance personnel should be allowed to enter the control room to use the computer equipment inside; or system operations/maintenance personnel may log in the computer equipment inside the control room using a one-time password through a designated equipment, the intranet and secure configuration for service control (e.g. firewall).3. The connection process should be carried out through an intranet, a leased line or a virtual private network.4. Where the network equipment and computer equipment in the control room constitute a part of the e-payment operating environment, those equipments shall comply with relevant provisions of these Regulations.
中文原文 電子支付機構資訊系統標準及安全控管作業基準辦法第15條
電子支付平臺之實體安全應符合下列要求：
一、主機房與異地機房應避免同時在地震斷層帶、海岸線、山坡地、海平面下、機場飛航下、土石流好發區域、百年洪水氾濫區域、核災警戒範圍區域、工安高風險區域，並應有相關防護措施，以避免受到地震、海嘯、洪水、火災或其他天然或人為災難之損害。
二、營運設備應集中於機房內，機房應建立門禁管制，以確保僅允許經授權人員進出；非授權人員進出應填寫進出登記，並由內部人員陪同與監督；進出登記紀錄應定期審查，如有異常應適當處置。
三、應於主機房及異地機房內建立全天候監視設備並確保監視範圍無死角。
四、應有足夠營運使用之電力、供水、用油等供應措施，當發生供應措施中斷時，應至少維持七十二小時運作時間，並應介接二家以上或異地二線以上網際網路電信營運商互為備援。
五、油槽儲存及消防安全應符合相關法規規定。
六、應設置環境監控機制，以管理電信、空調、電力、消防、門禁、監視及機房溫濕度等，並自動告警與通知。
七、機房管理應具備與機房相當之操作環境，或獨立可管制人員操作系統與設備之監控室。
前項第七款監控室應符合下列要求：
一、應具門禁與監視設備，且必須留存連線及使用軌跡，並定期稽核管理。
二、系統維運人員應經授權進入監控室使用監控室內專屬電腦設備；或應使用指定設備由內部網路以一次性密碼登入並經服務管控設備（如防火牆）使用監控室內專屬電腦設備。
三、連線過程須以內部網路、專線或虛擬私有網路進行。
四、監控室之網路設備與電腦設備如為電子支付作業環境之範圍，應符合本辦法相關規定。
一、主機房與異地機房應避免同時在地震斷層帶、海岸線、山坡地、海平面下、機場飛航下、土石流好發區域、百年洪水氾濫區域、核災警戒範圍區域、工安高風險區域，並應有相關防護措施，以避免受到地震、海嘯、洪水、火災或其他天然或人為災難之損害。
二、營運設備應集中於機房內，機房應建立門禁管制，以確保僅允許經授權人員進出；非授權人員進出應填寫進出登記，並由內部人員陪同與監督；進出登記紀錄應定期審查，如有異常應適當處置。
三、應於主機房及異地機房內建立全天候監視設備並確保監視範圍無死角。
四、應有足夠營運使用之電力、供水、用油等供應措施，當發生供應措施中斷時，應至少維持七十二小時運作時間，並應介接二家以上或異地二線以上網際網路電信營運商互為備援。
五、油槽儲存及消防安全應符合相關法規規定。
六、應設置環境監控機制，以管理電信、空調、電力、消防、門禁、監視及機房溫濕度等，並自動告警與通知。
七、機房管理應具備與機房相當之操作環境，或獨立可管制人員操作系統與設備之監控室。
前項第七款監控室應符合下列要求：
一、應具門禁與監視設備，且必須留存連線及使用軌跡，並定期稽核管理。
二、系統維運人員應經授權進入監控室使用監控室內專屬電腦設備；或應使用指定設備由內部網路以一次性密碼登入並經服務管控設備（如防火牆）使用監控室內專屬電腦設備。
三、連線過程須以內部網路、專線或虛擬私有網路進行。
四、監控室之網路設備與電腦設備如為電子支付作業環境之範圍，應符合本辦法相關規定。