"How many dedicated security staff do we need, and which certifications count?" is the staffing question government agencies, state-owned enterprises, critical infrastructure operators and government-related foundations ask most often under Taiwan's Cyber Security Management Act (資通安全管理法, "the Act"). The Act requires government agencies and specific non-government agencies to appoint dedicated cyber security personnel according to their cyber security responsibility level, with qualifications and staffing set by a separate regulation from the competent authority[1]. That regulation requires dedicated personnel to hold a cyber security professional certification announced by the competent authority, or a competency training certificate, and to keep it valid[2].

This article is for two readers: managers who must staff these roles or judge the weight of certifications on CVs and bids, and IT staff planning their next certification. It covers the legal requirement, the two lists published by the Administration for Cyber Security under the Ministry of Digital Affairs (ACS), how common certifications are positioned, and how to read certifications when hiring or choosing a vendor. It is not an exam-prep guide; for the Act as a whole, see Taiwan's Cyber Security Management Act.

The legal requirement: how many people, which credentials, by when

Articles 18, 20 and 21 of the Act require government agencies, critical infrastructure providers and other specific non-government agencies, respectively, to appoint dedicated cyber security personnel according to their responsibility level; Article 7 has the competent authority set the qualifications and staffing of those personnel by regulation[1]. That regulation is the Regulations Governing the Classification of Cyber Security Responsibility Levels, last amended on 7 January 2026, whose Annexes 1 to 8 set out what each level must do[2]:

  • Headcount: at least four at level A, two at level B and one at level C; the annexes for levels D and E have no dedicated-personnel requirement[2].
  • Who counts as dedicated: people who perform cyber security work full-time, with security as their main core duty and first priority; others who actually do security or IT work fall under "IT personnel other than dedicated cyber security personnel" in the annexes and do not count toward the headcount[2].
  • Certification or certificate: at specific non-government agencies each dedicated staff member must hold at least one "cyber security professional certification" or "cyber security competency training certificate"; at government agencies they need at least one of each; in both cases the credential must be kept valid[2][3].
  • Two terms: a professional certification means one announced by the competent authority; a competency training certificate means one issued after passing the competent authority's cyber security competency assessment[2].
  • Deadline: staffing and credentials must be in place within one year of the first level approval or a level change, and the same applies when personnel change[2].
  • Training hours: each dedicated staff member needs at least 12 hours a year of professional cyber security training or competency training[2]; training courses for certifications on the list count toward the professional training hours[3].

The ACS FAQ adds practical detail: dedicated staff do not have to sit in the IT department or belong to the IT job series, and headcount and credentials are counted per agency, so a parent agency and its subordinate agencies cannot pool them[3]. It also suggests a division of work: at level A, one person on strategy, one or two on management and one or two on technical work; at level B, one on strategy and management and one on technical work; at level C, one person coordinating all security work[3]. That split doubles as a map for choosing certifications (see the last section).

The ACS's two lists: professional certifications and competency training certificates

The cyber security professional certification list

At the time of writing (November 2026), the version of the ACS "Cyber Security Professional Certification List" on its website is the one amended and announced on 22 May 2026[4]. The list is organized by issuing body, 14 in all, and each certification is classed as either "management" or "technical"; this version has 22 management and 84 technical entries[4]. Issuers include ISC2, ISACA, CompTIA, EC-Council, GIAC, OffSec, CREST, Cisco, ISA, Hack The Box and Taiwan's Ministry of Economic Affairs, plus the certification and registration bodies that issue ISO management system auditor credentials[4].

Details to watch when reading the list:

  • Conditional entries: Lead Auditor certifications also require proof of at least two actual audits related to the certification in the current year[4]. The ACS explains that internal audits, external audits and audits of outsourced vendors all count, whether as auditor or observer[3].
  • Versions and phase-outs: ISO/IEC 27001:2013 certifications have not been recognized since 31 October 2025[3]. Certifications whose issuer has stopped issuing or withdrawn them generally stop being recognized one year after the list revision is announced; this version marks HCISPP as no longer recognized after 1 December 2026, and the certification formerly named Cisco Certified CyberOps Associate as no longer recognized after 20 January 2028[4]. Some GIAC certifications are marked "renewals only"[4].
  • The list changes: it is updated periodically, and agencies can propose additions through the ACS recognition review procedure[3].

Legally, the list determines whether dedicated personnel at organizations covered by the Act meet the annex requirements[2]. Companies outside the Act have no obligation to follow it, but it is still a regulator-reviewed reference that labels each certification as management or technical.

Cyber security competency training certificates

The competency training certificate is the other route: attend the competent authority's cyber security competency training, complete the required hours and pass the assessment; since April 2026, candidates can skip the "Introduction to Cyber Security" course and register directly for its assessment[3]. The certificate list has 21 subjects, one core subject ("Introduction to Cyber Security") and 20 professional subjects such as incident reporting and response, security audit practice, system and website penetration testing, and digital forensics[5]. Dedicated staff at specific non-government agencies need either a professional certification or a competency training certificate; government agencies need both[2].

Where common certifications fit

The certifications readers ask about most, grouped by purpose. Issuers, experience requirements and continuing education rules follow each issuer's official site; whether a certification is on the ACS list, and in which class, follows the 22 May 2026 list[4].

Management and governance: CISSP, CISM

  • CISSP: issued by ISC2 and aimed at people who lead an organization's security program. Besides passing the exam, candidates need five years of cumulative paid work experience in at least two of the eight domains of the exam outline; a relevant four-year degree or an approved credential can cover one year, and candidates without enough experience can become an Associate of ISC2 in the meantime; holders must earn continuing professional education (CPE) credits every year[6]. Management class on the list[4].
  • CISM: issued by ISACA and aimed at security management. Candidates need at least five years of information security management experience within the ten years before applying, across at least three of the four CISM domains, verified by a supervisor or manager; holders need at least 120 CPE hours per three-year period and at least 20 per year[7]. Management class on the list[4].

Audit and ISMS: CISA, ISO/IEC 27001 Lead Auditor and Lead Implementer

  • CISA: issued by ISACA and aimed at information systems audit. Candidates need at least five years of information systems auditing, control or security experience within the ten years before applying, with the same CPE rules as CISM[8]. Management class on the list[4].
  • ISO/IEC 27001 Lead Auditor: there is no single issuer. The list's management class accepts ISO/IEC 27001:2022 Auditor or Lead Auditor certifications issued by an accredited information security management system certification body or an international auditor certification or registration body, and only together with the two actual audits a year described above[4].
  • ISO/IEC 27001 Lead Implementer: aimed at helping an organization plan, implement and maintain an information security management system (ISMS), not at auditing it. At PECB, for example, the credential awarded after the exam depends on experience: with no work experience you can only get "Provisional Implementer", while "Lead Implementer" requires five years of work experience (two in information security management) and 300 hours of ISMS project activity[9]. The 22 May 2026 list does not include Lead Implementer[4]. For the ISMS itself, see ISO 27001.

Entry level and foundations: CompTIA Security+, iPAS Information Security Engineer

  • CompTIA Security+: CompTIA positions it as establishing the essential skills for core security functions, and recommends (but does not require) Network+ and two years of experience in a security or systems administrator role[10]. It is valid for three years and can be renewed through continuing education units, among other options[11]. Technical class on the list[4].
  • iPAS Information Security Engineer: organized by the Industrial Development Administration and issued by Taiwan's Ministry of Economic Affairs, at beginner and intermediate levels; the intermediate exam covers "information security planning practice" and "information security protection practice"[12]. The candidate profiles in the exam guide are only recommendations, and candidates may skip the beginner level; the beginner certificate never expires, while the intermediate certificate is valid for five years and renewal requires at least 48 hours of security-related training within those five years, with each year of security work counting for 8 hours, up to 40[12]. Only the intermediate assessment is on the list, in the technical class[4].

Offensive and hands-on: CEH, OSCP, GIAC

  • CEH: issued by EC-Council. Passing the multiple-choice knowledge exam earns the CEH; the practical exam is optional, and passing both earns CEH Master; eligibility comes from official training or an experience-based application[13]. EC-Council certifications are valid for three years, during which each certification needs 120 continuing education credits[14]. The list's technical class has separate entries for CEH, CEH Practical and CEH (Master)[4].
  • OSCP: issued by OffSec, through a 24-hour hands-on exam proctored by an OffSec employee, in which candidates find and exploit vulnerabilities and escalate privileges in a lab environment; there are no formal prerequisites, but networking, Windows and Linux administration and scripting skills are strongly recommended[15]. Passing earns both OSCP and OSCP+: OSCP has no expiry date, while OSCP+ expires after three years and can be maintained by a recertification exam, another qualifying OffSec exam or OffSec's CPE program[15]. The list's technical class includes both OSCP and OSCP+[4].
  • GIAC: the list splits GIAC certifications into groups: the management class includes management and audit certifications such as GSLC and GSTRT, and the technical class is grouped into cloud security, cyber defense, offensive operations, digital forensics and incident response, and industrial control systems, for example GPEN, GCIH, GCFA and GICSP[4]. GIAC recommends renewing through CPEs, collecting 36 credits over four years[16].

How employers should use certifications: hiring and choosing vendors

Decide the role first, then the certification

Using the ACS's suggested division of work[3]: people on strategy and management map to management-class certifications such as CISSP, CISM and ISO/IEC 27001 Lead Auditor; people on technical work map to technical-class certifications such as Security+, iPAS intermediate, GIAC and OSCP[4]. When a level C organization has a single dedicated person, that person handles both management and technical work; rather than chasing a senior management certification first, make sure they can handle the technical items the annex requires, such as vulnerability management, security testing and security health checks[2].

Certifications show knowledge, not hands-on ability

Many certifications test knowledge with a written exam; the CEH itself, for example, comes from a multiple-choice knowledge exam, with the practical exam optional[13]. OSCP, by contrast, requires actually compromising machines in a test environment within 24 hours[15]. CISSP, CISM and CISA add an experience check[6][7][8], but it verifies years of experience, not whether the person can get things done in your environment. Interviews should still include a practical task, such as handing over a firewall configuration or a log and asking the candidate to find the problem and explain how to handle it. Even the ACS does not rely on the certificate alone: a Lead Auditor certification only counts with two actual audits a year[4].

Ask about validity and continuing education

Certifications expire: Security+ and EC-Council certifications are valid for three years[11][14], GIAC requires 36 CPE credits over four years[16], iPAS intermediate must be renewed every five years[12], and ISACA certifications need at least 20 CPE hours a year[7]. The annexes also require dedicated staff to keep their credentials valid[2]. When hiring or doing the annual review, ask for the certification number and expiry date, verify with the issuer where needed, and ask for the latest continuing education record; that record says more than the year the certification was earned about whether someone has kept up with new technology.

Choosing vendors: look at the people doing the work, not the company profile

Article 7 of the Enforcement Rules of the Act requires agencies choosing a contractor to consider whether it assigns sufficient, appropriately trained security professionals who hold security certifications or have similar work experience[17]. In practice:

  • Ask for the names of the people who will actually do the work, with their certifications and expiry dates, not a company-wide count of certificate holders.
  • Penetration testing vendors: certifications earned through a hands-on exam such as OSCP/OSCP+[15], or a practical exam such as CEH Practical[13], say more about a tester's ability than certifications earned through a written exam alone. The list's technical class also includes penetration-testing-related certifications from GIAC, CREST and Hack The Box[4]; ask the vendor how those exams work, and weigh them together with a redacted sample report, the testing methodology and the retest arrangements.
  • ISMS consultants or audit vendors: beyond a Lead Auditor certification, ask for recent audits or implementations they actually carried out.
  • If you need outside help with the vulnerability scanning the annexes require, see vulnerability assessment and scanning. A certification is a threshold, not a guarantee; contracts still need to spell out deliverables, confidentiality and incident notification duties, and other outsourcing requirements are covered in Taiwan's Cyber Security Management Act.

Action checklist

  1. Confirm your responsibility level and required headcount, and list each dedicated staff member's certifications or competency training certificates, with numbers and expiry dates.
  2. At government agencies, check that each dedicated staff member has at least one certification and one certificate; at specific non-government agencies, at least one of either; and that all are valid.
  3. Compare holdings against the 22 May 2026 list and flag certifications being phased out (for example HCISPP, not recognized after 1 December 2026) and auditor certifications still on ISO/IEC 27001:2013.
  4. Have dedicated staff who hold a Lead Auditor certification keep records of at least two actual audits each year.
  5. Plan each person's 12 annual hours of professional training together with the continuing education each certification requires.
  6. For new or replacement dedicated staff, set a plan to obtain a certification or certificate within one year of the change.
  7. When hiring, choose certifications by the strategy, management or technical role, and add a practical interview.
  8. In procurement documents, require vendors to list the certifications and expiry dates of the people doing the work; for penetration tests, also require hands-on certifications and a sample report.
  9. Check the ACS website each year for list updates, and subscribe to follow new announcements.