Regulations for Administration on Type II Telecommunications Business Article 31-1

In one of the following conditions, operators shall construct information and communication security protection and detection facilities within one year upon receiving notification from the Competent Authority and conduct penetration tests, vulnerability scanning and maintenance and repairs on a regular basis. In addition, operators shall pass ISO/IEC 27001 international standards and information and communication security management verification on the added check list of ISO/IEC 27001 telecommunications business information and communication security management publication issued by the Competent Authority. The implementation of the verification shall be reported to the Competent Authority for approval and shall include the items of verification:I. When the system of operators reaches the third level or above in Guidelines for Report and Response Operations for National Information and Communication Security.II. In the case of potential harm to national security or information and communication security and is notified by relevant organizations.III. When key points, the number of users or scale of use, and control of operations and facilities are considered necessary by the Competent Authority.During the period of the preceding paragraph, the Competent Authority shall notify operators of the reduction of this period upon receiving notification from organizations related to national security or information and communication security.Operators applying for Type II Telecommunications Business shall submit information and communication security protection and detection facility proposals and are obliged to pass the information and communication security management verification of Paragraph 1 prior to obtaining their licenses when key points, the number of users or scale of use, and control of operations and facilities are considered necessary by the Competent Authority.Operators referred to in Paragraph 1 shall establish joint defense and response measures, such as notifying, treating, and reporting measures for information and communication security incidents in accordance with the information and communication security response operation procedure promulgated by the Competent Authority.In the case of information and communication security incidents, operators shall conduct emergency response measures, maintain records, and report to the Competent Authority for future reference in accordance with information and communication security incidents reported by the Competent Authority. In addition, the records shall be kept for at least six months.