Administration Regulations of Cyber Security on Telecommunications Business Article 3

The telecommunications enterprises shall, within three months upon receipt of the competent authority’s notification, establish the cyber security maintenance plan; submit it to the competent authority for reference; and implement the plan accordingly.Where the cyber security maintenance plan submitted by the telecommunications enterprise as described in the preceding paragraph is deemed incomplete, a revised plan shall be submitted accordingly within the duration prescribed by the competent authority.The management scope of the cyber security maintenance plan specified in Paragraph 1 shall include at least the following items:1. Equipment and functional devices of the telecommunications network, telecommunications equipment room and network management center;2. PSTN maintenance systems, including the operations maintenance system and business maintenance system. The operations maintenance system shall include core network and access network systems, whereas the business maintenance system shall include user data, customer services and accounting systems;3. Cyber security protection facilities established to protect those specified in the preceding two subparagraphs.With respect to the information and communications technology（ICT）system protection and classification methods of the cyber security maintenance plan specified in Paragraph 1, telecommunications enterprises shall comply with the protection levels and classification methods announced by the competent authority.