Regulations for Testing Body and Certification Body Management of Information and Communications Equipment Used by Critical Telecommunications Infrastructure｜第 3 條｜韌性建設｜Regulation｜In Force
數位發展部｜v1.0
Last Amended: 2021-01-29
The Testing Body shall be accredited by the Taiwan Accreditation Foundation（hereinafter the “Accreditation Organization”）and shall be capable of undertaking the tests listed in Technical Specifications announced by the competent authority. The Testing Body shall comply with the following requirements: 1. Shall be a domestic legal entity or institution established by law. 2. Compliance with CNS 17025 or ISO/IEC 17025 standards. 3. Shall not be engaged in the input, design, manufacturing or trading of the Equipment to be tested. 4. Include at least three professional and full-time personnel, consisting of one testing supervisor and two testing engineers. The personnel mentioned in Subparagraph 4 of the previous paragraph shall comply with the following requirements: 1. The Testing Supervisor shall: （1）Possess a bachelor’s degree or above, majoring in information engineering, information management or relevant department from a domestic or foreign public or private college or university recognized by the Ministry of Education. （2）Have at least five years of practical experience in cybersecurity related management or testing evaluation and understanding of regulations and technical specifications. （3）Acquire CNS 17025 or ISO/IEC 17025 training certificate. 2. The Testing Engineer shall （1）Possess a bachelor’s degree or above, majoring in information engineering, information management or relevant department from a domestic or foreign public or private college or university recognized by the Ministry of Education. （2）Have at least two years of practical experience in cybersecurity related testing evaluation. （3）Acquire a certificate of attending ISO/IEC 15408 testing and evaluation training program at least 40 hours. （4）Acquire a valid cybersecurity related professional license of Certified Ethical Hacker（CEH）or CompTIA Security+. （5）Acquire one of the following valid professional licenses related to cybersecurity: i.（ISC）2 Certified Information Systems Security Professional（CISSP）. ii. EC-Council Certified Security Analyst（ECSA）. iii. EC-Council Computer Hacking Forensic Investigator（CHFI）. iv. GIAC Penetration Tester（GPEN）. v.（ISC）2 Systems Security Certified Practitioner（SSCP）. vi. Offensive Security Certified Professional（OSCP）. After confirming the Testing Body meeting the requirements mentioned in the previous three paragraphs and accrediting the Testing Body, the Accreditation Organization shall submit the accreditation certificate of the Testing Body to the competent authority for reference. In order to enforce the Technical Specifications announced by the competent authority, the Testing Body shall put in place the necessary testing equipment to perform testing work. The competent authority may examine and audit relevant documents from the Testing Body and may also dispatch staff to the Testing Body to perform an onsite appraisal. The Testing Body shall not evade, interfere with or refuse such verification without justification.