Regulations Governing Implementation of Internal Control and Auditing System of Insurance Enterprises Article 6-1

An insurance enterprise shall set up a dedicated information security unit and appoint a head thereof, who may not concurrently handle information technology operations or other affairs that may pose a conflict of interest with his or her duties, and shall allocate appropriate human resources and equipment. However, where the competent authority has provided otherwise for insurance cooperatives, such provisions shall govern.An insurance enterprise whose total assets in the previous year, as audited and certified by a certified public accountant (CPA), amount to NTD 300 billion or more, or whose premium income from Internet insurance in the previous year amounts to NTD 500 million or more, shall appoint a person at the level of vice general manager or above, or a person with equivalent responsibilities, to concurrently serve as the Chief Information Security Officer (CISO) to oversee the promotion of information security policies and the allocation of resources, and shall establish a dedicated information security unit that independently exercises its functions and appoint a person at the level of associate general manager or above, or a person with equivalent responsibilities, to serve as the head of such dedicated information security unit.The CISO of an insurance enterprise shall report the overall implementation of information security from the preceding year to the board of directors (council) each year and report material information security issues in a timely manner.The dedicated information security unit of an insurance enterprise shall, each year, jointly issue an internal control system statement regarding the overall implementation of information security from the preceding year with the CISO (or the head of the dedicated information security unit if no CISO is appointed) and the personnel specified in Paragraph 1, Article 25, and submit the statement to the board of directors (council) for approval.The personnel of the dedicated information security unit of an insurance enterprise shall receive at least 15 hours of professional information security training courses or functional training annually. Other information technology personnel shall receive at least 6 hours of professional information security training courses or functional training annually. Personnel of the head office, domestic and foreign business units, product development management unit, fund utilization unit, asset safekeeping unit, and other management units shall receive at least 3 hours of information security awareness courses annually.An insurance enterprise governed by Paragraph 2 hereof shall make adjustments to become compliant within six months after it meets the applicable conditions set forth therein.