| Article 5 |
- An organization shall create a unit responsible for business continuity management with adequate workforce, materials and financial resources in place, to be responsible for promotion, facilitated supervision and review of business continuity management matters.
- An organization shall establish regulations for management, trainings, exercise and response and recovery relating to business continuity, and educate all staff and suppliers involving core business and core system to make them familiar with the applicable regulations.
- An organization shall select individuals with appropriate powers and authorities and professional capabilities to take the role and provide necessary education trainings on a regular basis.
|
| Article 6 |
- An organization shall identify its core business and core system annually.
- For Taiwanese subsidiaries or branches of a foreign business group whose core system is established at their foreign parent company or head office, after providing relevant documents based on the information and communication security regulations and mechanism established by their foreign parent company or head office, they may perform the core system evaluations only on aspects where evaluations may be performed based on the local practice.
|
| Article 7 |
An organization shall conduct regular BIA on an annual basis to evaluate the degree of impact caused by interruption to core business and generate the following analysis result to help assessment of strategies for core system recovery:
- An organization shall identify the business nature and important characteristics of core business, and determine the maximum tolerable period of interruption (MTPD), recovery time objective (ROT), minimum tolerable service level, and recovery point objective (RPO) of core business based on the results of identification, to be used as the basis of core system recovery.
- An organization shall determine the recovery time objective (RTO) and recovery point objective (RPO) of core system as the basis of backup planning and implementation of recovery operation.
- An organization shall list priorities of what to be recovered based on the importance of core business or recovery time objective (RTO), and identify allocation of resources necessary for meeting the minimum acceptable service level (including but not limited to site, infrastructures, network, telephone lines, information and communication system, office software and hardware, office equipment, reserve fund, staff, documents and suppliers necessary for recovery).
- An organization shall determine the minimum tolerable service level to be timely recovered after occurrence of disaster based on its operation strategies, operation objective, organizational size and resources, to reflect the risks the organization is willing to accept.
|
| Article 8 |
An organization shall create the backup and backup mechanism based on the results of BIA:
- An organization shall establish an adequate data backup mechanism based on the system characteristics and recovery point objective (RPO), considering backup frequency, type of storage media (optical disk, external drive, magnetic tapes), type of data (virtual DSM, source code, database, configuration files, etc.), type of backup (full backup, incremental backup and differential backup), method of backup (network synchronization, network asynchronization and offline backup).
- When establishing the data backup mechanism, an organization is advised to consider the "3-2-1 backup rule".
- Create at least three backup copies.
- Store backup copies separately on two different storage media.
- At least one copy is stored remotely.
- An organization shall establish the adequate system backup structure based on the system characteristics, needs of business unit and recovery time objective (RTO), such as mirror site, hot site, warm site or cold site.
- As part of its planning of backup and backup mechanism, an organization shall consider data traffic, backup network equipment, backup line, backup telecommunication service provider, and backup information security protection equipment.
- An organization shall periodically examine the on-site and remote system backup mechanism and on-site and remote data backup mechanism of core system to see if they satisfy the needs.
|
| Article 9 |
- As part of its planning of remote server room, an organization shall comply with the building and fire protection regulations promulgated by the government, with supporting facilities being taken into consideration, including power supply, HVAC arrangement, environment monitoring and warning system.
- Category 1 organizations shall have remote backup server room.
- Category 1 organizations shall install the main server room with the infrastructure enabling backup mechanism, such as double feeder lines, uninterruptible power system (UPS) designed for server room, power generator designed for server room, two or more telecommunication operators, and two or more external network lines.
- Category 1 organizations shall ensure its main server room and remote backup server room have sufficient power, water and gas supplies, sufficient for 72 hours of operation in the event of a supply interruption.
- When evaluating relocation of an existing server room or establishment of a new server room, an organization shall consider the following:
- With reference to the Server Room Remote Backup Mechanism Reference Guide by the Executive Yuan, the organization shall ensure the locations of its main server room and remote backup server room are unlikely to be affected by the same interruption risk incident (for example, in the same earthquake belt, in the same power supply area), or the distance of the main server room and remote backup server room is more than 30 kilometers.
- An organization shall consider the geological condition, natural disaster, man-made disaster (whether in the proximity of a nuclear power plant, a factory where chemical products or explosives are processed, directly under the aviation route near an airport, hospital with high traffic of patients, area with a high public security risk), facilities (water, power, gas supplies and online connection), transportation convenience, and staff's commute time, etc. when determining the location.
- An organization is advised to consider if too many enterprises in the same industry are sharing the same server room.
|
| Article 10 |
An organization shall create the disaster response mechanism to ensure personal injuries or losses to its core system and assets in the event of a disaster can be minimized. The mechanism shall include but not limited:
- To establish an internal unit relating to disaster response and business continuity with the following specific responsibilities:
- To deploy self-protection and fire-protection personnel.
- To deploy emergency reporting team or urgency action team.
- To identify risk scenarios that may cause interruption (including natural disasters, man-made disasters and information and communication security incident), and propose emergency response measures to avoid, prevent and respond to emergency based on various risk scenarios.
- To establish emergency response procedures, including escape, disaster risk reduction and evacuation as instructed by the self-protection and fire-protection team, and identify status of damage to staff, office premises, communication and information equipment and various assets.
- To create emergency reporting procedures and specify the entity responsible for reporting and its responsibilities.
- To create reporting procedures within the organization, including deployment of self-protection and fire-protection team, emergency response team or relevant responsible entities.
- To create procedures of reporting to external police and fire protection authorities (e.g. police department and fire brigade).
- To establish information security reporting mechanism (e.g. formal reporting procedures and contact person for reporting of information security breach). Information security or service abnormality relating to information system shall be handled in accordance with the Guidelines Governing Securities and Futures Market Information and Communication Security Incident Reporting and Response, and proper rectification procedures shall be taken and records shall be retained.
- Where reporting to competent authority or external entity such as trade associations is otherwise required by the law and regulation, relevant reporting procedures shall be established.
|
| Article 11 |
An organization shall establish a business continuity plan to ensure the minimum acceptable service level can be achieved within the recovery time objective (RTO) in the event of a disaster. It shall include but not limited to:
- Activation conditions.
- Description of participants and their responsibilities.
- To establish a business continuity management team or business continuity management commission.
- To review and determine the human resources for operation and support required for recovery of the core business.
- To appoint the person responsible for core system recovery and their agent.
- Emergency response procedures and emergency reporting procedures
- Recovery procedures and on-site and remote system recovery procedures for the core business (such as backup and recovery plans for computer equipment, communication equipment, power system, database, and computer operation system).
- Frequency of maintenance work for business continuity plan.
- Rules for trainings on business continuity.
- Response planning and appropriateness of contract with external entity.
|
| Article 12 |
An organization shall perform exercise designed for various scenarios and business conditions to achieve an effective operation of exercise and test procedures.
- An organization shall design exercise scenarios based on the identified risk scenarios that may cause interruption to core business (including natural disasters, man-made disasters and information and communication security incidents).
- An organization shall perform operations based on scenarios of disasters or accidents, considering to incorporate operating staff needed for the core system, personnel for performance of core business and suppliers required for recovery. It shall have a plan for system quantity, size and levels (dedicated server, virtual hosting, middleware, etc.) needed for the exercise.
- Prior to exercise, an organization shall identify possible risks (e.g. errors or losses of formal data that may be caused during the exercise, decreased information protection level that may be caused by the exercise, damage to client rights that may be caused by the exercise), and prepare protection measures in advance.
- Exercise shall cover verification of standard operational procedures created for various core systems (including but not limited to monitoring, tiered exercises, reporting, response and recovery).
- An organization shall perform regular exercise and verify feasibility of its core system every year, and make plans for on-site and remote system backup exercise, on-site and remote system reconstruction exercise (for system without backup), or on-site and remote data backup restorage tests based on needs to ensure the staff's familiarity and effectiveness of the procedures, with the records of these exercises to be retained.
- During remote system backup exercise, Category 1 organizations shall incorporate verification of actual business operation to validate internal resource arrangement and labor force deployment, coordination of external partners and adjustment and interfacing of information network on which minimum acceptable service level relies can effectively operate at all key moments. Category 2 organizations are encouraged to take the same action.
- An organization shall convene a review meeting after the exercise to confirm whether the recovery mechanism and results of exercise have met the recovery time objective (RTO) and recovery point objective (RPO) requirements established by the organization, and examine the core system to see if the existing on-site and remote system backup mechanism and on-site and remote data backup system meet the needs of core business.
|
| Article 13 |
- An organization shall ensure the original responsible person of the core system and their agent are capable, competent and are provided with sufficient trainings. Aspects and contents of trainings can include but not limited to recognition trainings, business continuity, most current relevant trends, backup technology trainings, succession of experiences from the exercise, relevant recent internal and external business continuity cases, changes to information and communication system structures, etc.
- An organization shall fully record the results of staff training and regularly examine the staff's recognition level, capabilities and appropriateness of training contents.
|
| Article 14 |
- When the core system is outsourced, an organization shall ensure, based on the scope and characteristics of outsourced services, the recovery level, recovery time objective (RTO) and recovery point objective (RPO) of the core system can support the core business for recovery to the minimum acceptable service level after occurrence of a disaster. The organization shall perform regular exercise every year to validate feasibility of its core system.
- An organization shall include the above requirements on business continuity management in the outsource contract.
|