Regulations Governing Implementation of Internal Control and Auditing System of Insurance Enterprises Article 6

An insurance enterprise that uses a computerized information processing system shall, in addition to clearly delineating the authority and responsibility of information and user departments, include at least the following control operations in its internal control system and observe the self-regulatory rules established by the trade association it belongs to:1. Clear division of authority and responsibility of the information processing department;2. Control of system development and program modification;3. System documentation control;4. Program and data access control;5. Data input/output control;6. Data processing control;7. Security control of the entrance of computer room;8. System, files, computer and communications equipment security control;9. Control of purchase, usage, and maintenance of hardware and system software;10. Prevention and control of spread of computer viruses and hacker invasion;11. Control of system recovery plan, disaster backup plan and testing procedures;12. Control of outsourcing of core businesses;13. Confidentiality and security control of classified data of customers and company; and14. Prevention and control of computer crimes.The Life Insurance Association of the Republic of China and The Non-Life Insurance Association of the Republic of China shall establish and periodically review self-regulatory rules for information security.