OTHER INFO
Continuous development and maintenance to improve our service quality.
:::
:::

Security Policy

Update:

Chapter I Objectives

The Regulations are hereby established to ensure the confidentiality, integrity and applicability of the information and ICT (information, communication and technology) systems of Printing Plant, Ministry of Finance (hereinafter referred to as the“Plant”), and to meet requirements of relevant laws and regulations. This can not only prevent the Plant from internal and external deliberate or unexpected threats, but also protect the rights and interests of our employees.

Chapter II Scope Of Applications

Information security management consists of 14 fields of activities, enabling the Plant to prevent misuse, leakage, tampering and damage of information caused by human errors, premeditation or natural disaster. The fields of control that help to protect the Plant from all types of potential risks and damages are as follows:

  1. A5. Security policy.
  2. A6. Information security organization.
  3. A7. Human resources security.
  4. A8. Assets management.
  5. A9. Access control.
  6. A10. Passwords.
  7. A11. Physical and environment security.
  8. A12. Operational security.
  9. A13. Communication security.
  10. A14. Information system access, development and maintenance.
  11. A15. Supplier relationship.
  12. A16. Information security incident management.
  13. A17. The information security aspect of Business Continuity Management (BCM).
  14. A18. Compliance.

Chapter III Policy

Be altered to social engineering, report information security incident, implement information safety measures, and reach business continuity

The following information security policies are formulated to implement this security policy of the information management system:

  1. Set the framework of ICT security targets to establish the principles of promoting the Plant’s ICT security measures.
  2. Take operational, legal or regulatory requirements and contractual security obligations into consideration.
  3. Adjust to the organization’s full view of strategic risk management; and establish and maintain the information security system therein.
  4. Establish risk assessment standards.
  5. The ICT policy shall be approved by the management and then announced and deliberated to employees and related external groups.
  6. Regularly back up and test information and software of important information and ICT systems (A12.3.1).
  7. Protect information exchange of used communications facilities (A13.2.1).
  8. Protect information connected to the business information system (A14.1.3).
  9. Establish, document and examine access controls based on the operational and security requirements of access (A9.1.1).
  10. Paper documents and media must be cleared from the table and screen; and control portable media (A.11.2.9).
  11. Ensure that the computer connection and information do not violate access controls of the Plant’s application system (A9.1.2).
  12. Adopt appropriate security measures to prevent risks derived from the use of mobile equipment and communication facilities (A6.2.1).
  13. Use password control measures to ensure ICT security (A10.1.1).
  14. Ensure suppliers’ ICT security requirements have been met (A15.1.1).
  15. The confidentiality and integrity of confidential and sensitive information must be protected. Unauthorized access and tampering must be avoided.
  16. Do not open e-mails of unknown or unidentified senders.
  17. The tenacity of core ICT system must be reinforced to ensure continuous operations of the organization’s operations.
  18. To enhance our employees awareness towards ICT, hold ICT security trainings to respond to ICT security threats and changes related thereto. All employees of the plant shall truly participate in the trainings.
  19. It is prohibited to have one ICT system account shared by many people.
  20. Above policy must be reviewed by the management each year on a regularly basis.

Chapter IV Goals

Maintain the confidentiality, integrity and applicability of the Plant’s information and ICT systems, and protect the privacy of user data. The following goals can be reached with the efforts of all of our staffs:

  1. Protect information related to the Plant’s business activities; and avoid unauthorized access thereto.
  2. Protect information related to the Plant’s business activities; avoid unauthorized amendments thereto; and ensure the accuracy and integrity thereof.
  3. Establish operational plan for information business continuity to ensure continuous operations of the Plant’s business activities.
  4. The implementation of the Plant’s business activities shall comply with relevant legal and regulatory requirements.

Chapter V Responsibilities

  1. The Plan’s management establishes and examines this policy.
  2. ICT manager shall, through appropriate standards and procedure, implement this policy.
  3. All personnel and contractual suppliers follow the procedures to maintain ICT policy.
  4. All personnel have the responsibilities to report security incident and any identified weakness.
  5. Any intentional violation of ICT security policy will be dealt with relevant regulations or legal action.

Chapter VI implementation

This policy shall be evaluated at least once each year to respond to the up-to-date development of government regulations, technology and business activities; and to ensure the Plant’s capability in maintaining the operations and offering appropriate services.

Chapter VII Examination

  1. The ICT security policy shall be examined at the management examination meeting.
  2. Up approval of the plant director, the policy will be implemented on the date of promulgation; and will be notified to the Plant’s employees and agencies, organizations and suppliers whom are connected to the Plant’s operations in writing, by e-mail or other methods. The same shall be applied when there is any amendment thereto.