Regulations for Testing Body and Certification Body Management of Information and Communications Equipment Used by Critical Telecommunications Infrastructure｜第 5 條｜韌性建設｜Regulation｜In Force
數位發展部｜v1.0
Last Amended: 2021-01-29
An applicant to become qualified as a certification body（hereinafter the Applicant）shall be: 1. Domestic legal entity or institution established in accordance with laws. 2. Does not engage in the input, design, manufacturing or trading of the Equipment to be certified. 3. Compliance with CNS 17065 or ISO/IEC 17065 standards. 4. Include at least two full-time certification personnel. The certification personnel mentioned in Subparagraph 4 of the previous paragraph shall comply with the following requirements: 1. Possess a bachelor’s degree or above, majoring in information engineering, information management or relevant department from a domestic or foreign public or private college or university recognized by the Ministry of Education. 2. Have at least five years of practical experience in cybersecurity related management or testing evaluation and understanding of regulations and technical specifications. 3. Acquisition of CNS 17065 or ISO/IEC 17065 training certificate. 4. Acquire one of the following valid professional licenses related to cybersecurity: （1）（ISC）2 Certified Information Systems Security Professional（CISSP）. （2）EC-Council Certified Security Analyst（ECSA）. （3）EC-Council Computer Hacking Forensic Investigator（CHFI）. （4）GIAC Penetration Tester（GPEN）. （5）（ISC）2 Systems Security Certified Practitioner（SSCP）. （6）Offensive Security Certified Professional（OSCP）. 5. No personnel shall also serve as personnel under Subparagraph 4, Paragraph 2, Article 3.