Administration Regulations of Cyber Security on Telecommunications Business Article 4

Telecommunications enterprises shall, within two years upon the provision of telecommunications services, successfully obtain the following cyber security management compliant verification standards and maintain the validity thereof accordingly:1. CNS 27001 national standards or ISO/IEC 27001 international standards;2. The Additional ISO/IEC 27011 Audit List of the Cyber Security Management Manual for Telecommunications Enterprises.The scope of the verification specified in the preceding paragraph shall be reported to the competent authority prior to the verification for approval. The same rule shall apply to any amendment subsequently made.Where any of the following circumstances occurs, the telecommunications enterprise shall propose amendments to the scope of verification upon notification of the competent authority; and shall successfully obtain the cyber security management compliant verification within the period prescribed by the competent authority:1. Where a cyber security incident that occurred has reached level 3 as specified in Regulations on the Notification and Response of Cyber Security Incident;2. Where a relevant agency has provided a warning of potential harm to national or information security;The competent authority may require the telecommunications enterprises to reduce the duration specified in Paragraph 1 upon notification from the national security or cyber security related agency.