National Tax Administration, Southern Taiwan Province Information Safety Policy
Amended on: 9 August 2006 |
 |
Purpose |
|
In order to strengthen the information security management in National Tax Administration of Southern Taiwan Province (NTAS), ensure the safety of tax data, systems and facilities, and provide reliable information service, composing this information security policy. |
|
Basis |
| |
"The Information Security Management Practices of Ministry of Finance and Affiliated Organizations (Institutions)" is promulgated by the Ministry of Finance on 24 June 2002 under Decree No. 91895856. |
|
|
Definition of Information Security |
| |
| The information security is applying the management procedure and the protection technology to ensure the safety of data collecting, processing, transferring, storing, and communicating. While executing information works, it should also ensure the safety of related information systems, including participated software, facilities, files, storage media, and every kinds of report made by printer. |
|
|
Objective of Information Security |
| |
- Ensuring the confidentiality and privacy of tax data, and preventing them from unauthorized access.
The number of unauthorized access should not exceed 0 times.
- Ensuring the availability , integrity and non-repudiation of information assets.
The number of service halt due to information security events should not exceed 3 times semi-annually, and not longer than 12 hours each time.
- Ensuring the efficiency and continuity of information service operation.
Every half year, performing “Information Service Operation Continuity Plan ” rehearsal at least once, and performing all the scenarios within two years.
- Ensuring the information security awareness for every staff.
Each person should take at least 4 hours information security awareness or training.
- Ensuring the regulation compliance of information security measure.
Performing internal audit at least once every half year, if auditing affiliated institution in random basis, all of them should be audited within 2 years.
|
|
|
Extent of Information Security |
| |
- Information security responsibility and separation of duty.
- Human resource management and information security awareness and training.
- Information system security management.
- Network security management.
- Access control management.
- Information system acquisition, development and maintenance.
- Information asset management.
- Physical and environmental security management.
- Business continuity management.
- Information security audit.
- Information security incident management.
|
|
Organization of Information Security |
| |
- Establishing "Information Security Task Force, ISTF", the deputy commissioner serves as convener, members of ISTF are appointed by every division and office. The responsibility of ISTF is composing and reviewing this policy regularly, coordinating and discussing information security plan and resource allocation.
- There are "Information Security Task Group, ISTG" and "Information Security Audit Group, ISAG" under the ISTF. The ISTG handles the related assistance work of ISTF, and is convened by the Information Management Division. ISAG is in charge of information security internal audit.
|
|
Principle of Information Security Delegation |
| |
- Discussion of information security policy, plan, measure, technical specification, research of security technology, implementation and assessment are held by the Data Gathering & Electronic Data Processing Division.
- While executing information work, should comply with “Tax Collection Act”, “Computer Data Processing Act”, other related regulations and every procedure composed by NTAS.
- Technical information security training is held by the Data Gathering & Electronic Data Processing Division, and the business related information security training is held by the Government Ethics Office and associated division and office.
- The discussion, control, management and protection of security requirement for data and information systems are taken responsibility by business units.
- The Data Gathering & Electronic Data Processing Division and the Government Ethics Office are in charge of information security internal audit.
- The personnel security assessment is held by the Government Ethics Office.
- When the information and network systems of NATS are destroyed and improperly used, which cause serious damage should be mitigated by following the “Information Security Emergency Response Procedure”. ISTG should take countermeasure as soon as possible, and keep the audit trail.
- When personnel of NTAS violate the information security regulation, he/she should be charged according to the "Ministry of Finance Tax Affairs Personnel Rewards and Punishment Table". If someone who violates the "Official Disciplinary Punishment Act", should be charged by this law 19th stipulation; if the suspect who offends the "Criminal Law", should give transfers the judicial organ to investigate; if someone involves the national compensation event, should be charged by the "National Compensation Act" and other correlation law for investigating the correspondent responsibility. When non-NTAS personnel violate the information security regulation, also should be charged by the correlation legal rule to investigate the individual’s legal responsibility.
|
|
Information Asset Assessment |
| |
- Categorization:
According to the characteristics of information works, divide the assets into 6 categories, including electronic information assets, physical assets, software assets, services, documentation and people.
- Grade:
According to the confidentiality, integrality and availability of all kinds of assets evaluates its value.
- Assessment:
Considering the asset's own vulnerability, related threat and impact, assess the risk level, and then apply the appropriate measure on it.
|
|
Risk Appetite |
| |
After risk assessment, assets are divided into different risk levels. When those falls into “unacceptable risk level”, we should compose the related risk countermeasure plan to mitigate the impact and keep track of it. |
|
Statement of Applicability |
| |
According to ISO27001: 2005 standard requires the statement of applicability as output, it is necessary to enumerate information assets whether applicable to the control measure of this standard in written way, and record the reason of non-applicability. When organization framework, people, facilities or physical environment change, ISTF should review this statement of applicability. |
|
|
