Regulations for Administration of Mobile Broadband Businesses Article 83-1

Upon receipt of the concession license, the operator shall establish information security protection and detection facilities within one year, and pass the following information security management verification within two years:1.The national standard CNS 27001 or the international standard ISO/IEC 27001.2.The New Item Audit Form of the Telecommunications Enterprise Information Security Management Manual ISO/IEC 27011 announced by the competent authority.Operators that have already obtained a concession permit prior to the amendment to Regulations on May 22, 2017 shall establish information security protection and detection facilities within a year after the amended promulgation date, and shall pass above-mentioned information security management verification within two years after the said date.The implementation of verification and information security protection and detection facilities as described in the preceding two paragraphs shall be reported to the competent authority for approval.Where the operator falls under any of the following circumstances, an amendment shall be made to the implementation of the verification described in Paragraph 1 and Paragraph 2 according to the notification of competent authority. An approval shall also be received from the competent authority and the operator shall pass the information security management verification within the prescribed deadline notified by the competent authority:1.Where the information security incident that has occurred to the system reached level 3 of the level of concern as described in Regulations Governing National Information Security Reporting and Responding Operations.2.Where relevant agency has notified a potential harm to the nationalor information security.Where there is any potential harm to national or information security, the competent authority, upon receipt of relevant agency's notification, may require the operator to shorten the period aforementioned in Paragraph 1 and Paragraph 2.The operator shall not only conduct penetration test (PT), weakness scanning and maintenance work on a regular basis, but also establish defense and response measures to notify, handle and report information security incidents in accordance with the information security response operating procedures announced by the competent authority.Where an information security incident takes place, the operator shall, according to information security incident notified by the competent authority, conduct emergency response measures, retain relevant records, and report to the competent authority. The said records shall be preserved for at least six months.