Regulations for Administration of Mobile Broadband Businesses Article 55-2

Operators shall, within three months from the date of notification by the competent authority, undertake an inventory check of its telecommunications infrastructure in accordance with the Regulations on Selecting the National Critical Infrastructure issued by the Executive Yuan. For infrastructure listed as critical telecommunications infrastructure, the self-assessment of critical telecommunications infrastructure shall be conducted; the operator shall submit the National Critical Infrastructure Basic Information Form to the competent authority to assess the items and levels of its critical infrastructure.If the mandatory provision items on the National Critical Infrastructure Basic Information Form provided by the operator specified in the preceding paragraph are incomplete, the operator shall undertake corrective actionwithin a specified period oftime stipulatedby the competent authority.Within three months from the date the competent authority assesses the items and levels of the critical infrastructure, the operator shall complete the critical infrastructure security protection plan of the mobile broadband business in accordance with the format and items of the National Critical Infrastructure Security Protection Plan Framework issued by the Executive Yuan, and submit it to the competent authority for reference.If the content of the critical infrastructure security protection plan provided by the operator specified in the preceding paragraph is incomplete, the operator shall undertake corrective actionwithin a specified period oftime stipulatedby the competent authority.Operators shall conduct their own drills regularly in accordance with their critical infrastructure security protection plans and make written records, which shallbe retained for five years.The competent authority may designate the operator to conduct drills in accordance with its critical infrastructure security protection plan;the competent authority shall evaluate the drillsundertaken; if there are matters to be improved in the evaluation results, the operator shall undertake corrective actionwithin a specified period oftime stipulatedby the competent authority.