Taiwan's Cyber Security Management Act (資通安全管理法, "the Act") sets the security obligations of government agencies and "specific non-government agencies": responsibility levels, cyber security maintenance plans, audits, a chief information security officer (CISO) and incident reporting[1]. A full-text amendment of 35 articles was promulgated on 24 September 2025, and the Executive Yuan set 1 December 2025 as its effective date[2]. The enforcement rules and the main regulations under the Act were revised in January 2026.

This overview is for IT and security staff at state-owned enterprises, critical infrastructure operators and government-related foundations, and for vendors that build or run their systems. The amendment expanded the Act from 23 to 35 articles and renumbered most provisions[2], so update internal documents that cite old article numbers. Article numbers below refer to the amended text.

Where things stand: the amended Act and its regulations are in force

According to the Executive Yuan, the main changes are: audits now reach bodies with no supervising agency, such as the Five Yuan (the top branches of government) and local governments; government agencies and specific non-government agencies must appoint a CISO and dedicated security staff, backed by suitability checks; contractors must have sound security management or third-party certification; the competent authority is empowered to control high-risk products; and a support mechanism helps private organisations respond to major incidents[3].

The competent authority is the Ministry of Digital Affairs (數位發展部, MODA), and cyber security affairs are carried out by an agency that MODA designates[1]; the enforcement rules name it as MODA's Administration for Cyber Security (資通安全署)[4].

As of November 2026 the main regulations are all in force:

  • Enforcement Rules of the Cyber Security Management Act (資通安全管理法施行細則): full text of 15 articles amended on 5 January 2026, effective on issuance[4].
  • Regulations Governing the Classification of Cyber Security Responsibility Levels (資通安全責任等級分級辦法): Articles 1, 3, 10 and 11 and Appendices 1 to 7 and 10 amended on 7 January 2026, effective on issuance[5].
  • Regulations Governing the Reporting, Response and Drills for Cyber Security Incidents (資通安全事件通報應變及演練辦法): renamed from the former incident notification and response regulations and amended in full (20 articles) on 5 January 2026, effective on issuance[6][7].

Who must comply: government agencies and four kinds of specific non-government agency

The Act covers two groups[1]:

  • Government agencies: central or local agencies (organisations) or public juristic persons that exercise public power by law, excluding military and intelligence agencies.
  • Specific non-government agencies: critical infrastructure providers, government-owned enterprises, designated foundations, and enterprises, organisations or institutions controlled by the government.

Critical infrastructure providers are designated by the central competent authority for their sector, approved by the Executive Yuan, and notified in writing[1]. Designated foundations are nationwide foundations that meet specific provisions of the Foundations Act; government-controlled entities must be designated by the sector authority and approved by MODA[1].

In other words, an ordinary private company, including most listed companies, is not directly regulated by the Act unless it has been designated a critical infrastructure provider or falls into one of the categories above. Such companies often take on obligations through outsourcing contracts (see below); listed companies also have securities-market rules, covered in Cyber incident disclosure by Taiwan-listed companies.

Responsibility levels A to E: how much you have to do

Government agencies and specific non-government agencies must have their cyber security responsibility level approved by, or recorded with, the competent authority, based on factors such as the importance and sensitivity of their operations, the information they hold and the scale of their systems. They must then implement protection measures covering management, technology, awareness and training[1].

The classification regulations define five levels, from A (highest) to E[5]:

  • Level A: for example, operations involving state secrets, nationwide public services or nationwide personal data files, or a critical infrastructure provider whose system failure would have a catastrophic or very serious impact; public medical centres.
  • Level B: for example, regional or local public services or personal data files, or a critical infrastructure provider whose system failure would have a serious impact; public regional or district hospitals.
  • Level C: operating systems built or developed in-house or by contractors that have access control and management functions.
  • Level D: handling IT work in-house without operating such systems.
  • Level E: having no systems and providing no IT services, or having all IT work handled by another agency.

An agency that meets more than one level is assigned the highest one[5]. The level determines the required measures listed in the appendices. For specific non-government agencies[5]:

  • Level A (Appendix 2): an information security management system such as CNS 27001 or ISO 27001 for all core systems, with impartial third-party certification; at least four dedicated security staff; internal audits twice a year; core-system vulnerability scans twice a year and penetration tests once a year; an annual security health check; security monitoring and endpoint detection and response.
  • Level B (Appendix 4): third-party certification is also required; at least two dedicated staff; an internal audit once a year.
  • Level C (Appendix 6): an information security management system for all core systems, without mandatory third-party certification; at least one dedicated staff member; internal audits, vulnerability scans, penetration tests and health checks every two years.
  • Level D (Appendix 7): antivirus software and a network firewall, plus security training.

Where the amended appendices add or change a requirement, the deadline runs from the date the amendment took effect[5], so agencies with an approved level should check each deadline.

Core duties: maintenance plan, implementation reports, audits and the CISO

Cyber security maintenance plan

Critical infrastructure providers (Article 20(2)) and other specific non-government agencies (Article 21(1)) must meet the requirements of their level, appoint dedicated security staff, and formulate, revise and implement a cyber security maintenance plan[1]. Article 9 of the enforcement rules lists 13 required elements, including core business and its importance, security policy and objectives, staffing and budget, the CISO, a system inventory identifying core systems, risk management, protection and control measures, incident reporting, response and drills, threat intelligence, outsourcing management, and continuous improvement[4].

Implementation reports and audits

Critical infrastructure providers must report on implementation of the plan to their sector authority and are audited periodically; for other specific non-government agencies, the sector authority "may" request implementation reports and "may" audit[1]. MODA may also audit on a regular or ad hoc basis (Article 8)[1]. Audit findings require a corrective action report stating the deficiency, its cause, the fix and a target date[4].

CISO and dedicated staff

A specific non-government agency must appoint a CISO, who may be its representative, manager, another person with authority, or an appropriate person they designate (Article 23)[1]. Staffing numbers, training and certification follow the appendix for the agency's level[5].

Products harmful to national cyber security

The sector authority may restrict or prohibit specific non-government agencies from downloading, installing or using products harmful to national cyber security. Where there is a business need and no alternative, use requires approval by the CISO and the sector authority, case by case and recorded in a register (Article 27)[1].

Incident reporting and response: 1 hour, 36/72 hours, 1 month

The incident reporting regulations define four incident levels, based on whether core business or critical infrastructure operations are involved, how serious the disclosure or tampering is, and whether systems recover within the tolerable downtime[6]. Level 3 and level 4 incidents are "major cyber security incidents"[4].

Deadlines for specific non-government agencies[6]:

  • Report within 1 hour of becoming aware of an incident, in the manner designated by the sector authority, and report again if the incident level changes. If the designated channel is unavailable, report by another appropriate means within the same hour and state why (Article 11).
  • Complete damage control or recovery within 72 hours for level 1 or 2 incidents, or within 36 hours for major incidents, and notify as designated (Article 13(1)).
  • Submit a report within 1 month: after damage control or recovery, continue the investigation and submit an investigation, handling and corrective action report within one month; the sector authority may agree to an extension (Article 13(2) and (3)).
  • After a major incident, the CISO must convene a meeting on the response (Article 14(3)).

The report must cover key timestamps, scope and damage, the handling process, root cause analysis, and measures to prevent recurrence with target dates[4]. When investigating a major incident, the sector authority may require statements in person, forensic or investigation reports from an independent third party, or on-site inspection (Article 25)[1].

Penalties[1]: failing to report an incident carries a fine of NT$300,000 to NT$10 million and an order to correct, with repeated fines if not corrected (Article 29). Failing to adopt or implement a maintenance plan, submit required reports, or establish a reporting and response mechanism leads to an order to correct, then repeated fines of NT$100,000 to NT$5 million if not corrected (Article 30). Evading, obstructing or refusing an investigation carries a fine of NT$100,000 to NT$1 million (Article 31). Incidents involving personal data must also be handled under the Personal Data Protection Act (Article 33)[1]. For the order of work during an incident, see The first 24 hours.

Why companies outside the Act still feel it

Article 10 requires government agencies and specific non-government agencies that outsource system development, operation or IT services to choose suitable contractors, require effective security management from them, and supervise it. The contractor's processes and environment must have sound security measures or impartial third-party certification, and the parties must sign a written contract setting out rights, obligations and liability for breach[1], so these requirements end up in the supplier's contract.

Article 7 of the enforcement rules lists what the outsourcing party must consider when choosing and supervising contractors. Points that directly affect suppliers include[4]:

  • Security staff with appropriate training, security certifications or comparable experience.
  • Whether subcontracting is allowed, and the security measures required of subcontractors.
  • Security test evidence for custom-built systems; for the client's core systems or contracts of NT$10 million or more, the client must test the system itself or commission a third party; components not developed by the contractor must be identified with their source and licence proof.
  • Immediate notice to the client of any security incident, with remedial measures.
  • Return, transfer, deletion or destruction of the client's data when the contract ends.
  • Audits or other checks by the client, periodically or when an incident becomes known.

In a major incident investigation, "related parties" are contractors connected with the incident. They can also be required to give statements, submit third-party forensic reports or allow inspection, and the Article 31 fine applies if they evade, obstruct or refuse[1]. If a product is designated as harmful to national cyber security, government agencies may not use it and specific non-government agencies may be restricted or prohibited from using it (Articles 11 and 27)[1]. For the technical side of supplier risk, see Supply chain attacks.

Action checklist

  1. Confirm your status: have you received a written designation as a critical infrastructure provider, or are you a state-owned enterprise, designated foundation or government-controlled entity? If not, list which of your customers are covered by the Act.
  2. Confirm your responsibility level and its approval (or recordation) date, then list every required measure in the relevant appendix with its deadline, especially items added or changed in January 2026.
  3. Update old article numbers and regulation names in internal procedures, contracts and training material.
  4. Check that your maintenance plan covers the 13 elements in Article 9 of the enforcement rules, and that your CISO appointment and dedicated staff numbers match your level.
  5. Rehearse the 1-hour report: who decides the incident level, which channel you use, and the fallback if it is down. Build the 36/72-hour and 1-month deadlines into your response procedure.
  6. Compare outsourcing contracts against Article 7 of the enforcement rules. Contractors should have certification, security test reports, an incident contact and data return and deletion procedures ready.
  7. Follow regulator updates and changes to the regulations through our newsletter and advisories.

This is a general overview, not legal advice; check the current text on the Laws & Regulations Database, the rules of your sector authority and any official interpretations before acting.