- 英文摘要
- The digital economy has become the focus of economic development in various countries. The COVID-19 epidemic has prompted all industries to invest in digital transformation. However, the rapid changes in information and communication technology, together with the multiple applications of data have also aggravated information security issues. Information security risk has become a major challenge for current business operations, but its management involves many levels and considerations.
Facing the threats brought by information security risks to enterprises, establishing a management mechanism that adequately responds to relevant risks has become an important task in dealing with information security risk issues. In particular, whether and how an enterprise can link information security risks with business operations by setting up a “Chief Information Security Officer” to fully judge the actual scope and degree of impact of information security incidents on business operations.
The Federal Information Security Management Act of the United States emphasizes the importance of the “Information Security Officer”, while leading major countries also formulate similar regulations. Taiwan’s Cyber Security Management Act is the first to clearly stipulate the establishment requirements of the “Chief Information Security Officer” at the legal level. At the level of non-government agencies, the Financial Supervisory Commission proposed and expanded the requirements for setting up chief information security officers in the “Financial Security Action Plan” and “Financial Security Action Plan 2.0”, as well as adopted a phased and hierarchical approach to promote it.
When the issue of personal data protection is taken seriously and leads to discussions on whether to set up a privacy officer/personal data protection officer, our country can also refer to the requirements for the establishment of an information security officer, and gradually promote this mechanism in a hierarchical manner. The establishment of an information security officer will gradually become an indispensable item in the operation of each enterprise, assisting enterprises to fully develop while effectively accommdating the management needs of information security risks that arise during the development process.
- 目次
- 壹、前言
貳、資訊安全長之重要性與設置規範分析
一、資訊安全風險頻生突顯「資訊安全長」之價值
二、「資訊安全長」之概念、職責與設置必要性
三、我國資通安全法首見法律層級「資訊安全長」概念
四、源自美國FISMA之「資訊安全長」機制設計
五、非公務機關層面之「資訊安全長」設置規範分析
六、小結
參、隱私長（個人資料保護官）機制之對照觀察
一、個人資料外洩事件頻傳帶動保護需求
二、各國個人資料保護立法普遍受歐盟GDPR影響
三、應否設置隱私長／個人資料保護官機制受到重視
四、我國個人資料保護法相關規定之觀察
五、現時主要國家立法中之有關規範分析
六、國內後續思考議題
肆、結語
