Regulations of Special Non-official Agencies' Cyber Security Management by National Communications Commission Article 5

Certain non-official agencies shall be selected each year by the Commission to audit the implementation of their cyber security maintenance plans by means of on-site audit.In order to conduct the audit specified in the preceding paragraph, the Commission shall establish an audit plan, including audit related matters such as the composition method of the audit team, audit method, period, items and content, benchmarks and methods, confidentiality obligations, etc.When determining the benchmarks and items of the audit plan specified in the preceding paragraph, factors such as the nation’s cyber security policy, domestic and international cyber security trends, past audit effectiveness, audit resources, etc shall be comprehensively considered by the Commission.When selecting the specific non-official agencies to be audited in accordance with the provisions of Paragraph 1, the level of cyber security responsibility, the frequency and extent of the occurrence of cyber security incidents, the results of cyber security exercises, the frequency and results of the audit, and other cyber security related factors shall be comprehensively considered by the Commission.