Regulations Governing the Standards for Information System and Security Management of Electronic Payment Institutions Article 20
The outsourcing management of e-payment operating environment shall meet the following requirements:1. Before outsourcing, carry out proper security assessment of prospective service provider and undertake security control design based on the principles of least privilege and minimum disclosure.2. The outsourcing contract or relevant documents should explicitly agree on the following particulars:(1) The outsourced service provider shall observe these Regulations and other suitable international standards and requirements for information security to ensure the security of data furnished by client.(2) Undertake proper supervision of the outsourced service provider in accordance with the provisions of these Regulations.(3) When the security of outsourced operation is breached, the outsourced service provider should take the initiative to promptly inform the client.(4) The outsourced service provider shall ensure that the system or program it delivers does not contain malware or backdoor, and any program placed over the Internet shall have passed the program code scan or black box testing.3. Conduct information security audit of the outsourced service provider or ask the outsourced service provider to provide information security audit report at least once a year.
中文原文 電子支付機構資訊系統標準及安全控管作業基準辦法第20條
電子支付作業環境之委外管理應符合下列要求：
一、委外處理前應先對受託廠商進行適當之安全評估，並依據最小權限及資訊最小揭露原則進行安全管控設計。
二、委託契約或相關文件中，應明確約定下列內容：
（一）受託廠商應遵守本辦法及其他適當資訊安全國際標準要求，確保委託人資料之安全。
（二）對受託廠商應依本辦法內容進行適當監督。
（三）當委外業務安全遭到破壞時，受託廠商應主動、即時通知委託人。
（四）交付之系統或程式應確保無惡意程式及後門程式，其放置於網際網路之程式應通過程式碼掃描或黑箱測試。
三、應對委外廠商進行資訊安全稽核或由委外廠商提出資訊安全稽核報告，至少每年一次。
一、委外處理前應先對受託廠商進行適當之安全評估，並依據最小權限及資訊最小揭露原則進行安全管控設計。
二、委託契約或相關文件中，應明確約定下列內容：
（一）受託廠商應遵守本辦法及其他適當資訊安全國際標準要求，確保委託人資料之安全。
（二）對受託廠商應依本辦法內容進行適當監督。
（三）當委外業務安全遭到破壞時，受託廠商應主動、即時通知委託人。
（四）交付之系統或程式應確保無惡意程式及後門程式，其放置於網際網路之程式應通過程式碼掃描或黑箱測試。
三、應對委外廠商進行資訊安全稽核或由委外廠商提出資訊安全稽核報告，至少每年一次。