Jump to the main content block
  1. Home
  2. Information Security Policy

Information Security Policy

Information Security Policy

I.    Information Security Policy
In order to successfully operate the business of National Tsing Hua University (NTHU), to protect the information system or information and communications systems from unauthorized access, use, control, leakage, breakage, tampering, destruction or other infringement, and to ensure the Confidentiality, Integrity and Availability of the information system or information and communications systems, NTHU hereby sets forth the policy below for all colleagues to follow:

  1. Establish an information security risk management mechanism to regularly review the effectiveness of information security risk management in response to the internal and external changes in the information security situation.
  2. Safeguard the confidential and sensitive information and the confidentiality and integrity of the information system or information and communications systems from unauthorized access and tampering.
  3. Strengthen the resilience of the core information and communications system in order to ensure the continuous operation of the agency's businesses.
  4. Organize educational training on information security to prepare for the changing situations of information security and to raise information security awareness among NTHU’s personnel. NTHU's personnel should participate in the training.
  5. Award a personnel who has made contributions to information security business.

II.    Goals
To evaluate the achievement of information security management goals, NTHU hereby sets forth the following information security management indicators:

  1. Quantitative Indicators
  1. To ensure that the maintenance and operation services of NTHU Computer and Communication Center's computer room are available 98% or more of the working hours (or statutory working days) throughout the year.
  2. To ensure that the service availability rate of each core business system reaches 98% of the working hours (or statutory working days) throughout the year.
  3. The total number of core business systems' cyber security incidents which result from human or operational negligence and unauthorized access shall not exceed four times per year.
  4. To ensure that NTHU's information security measures and rules comply with the requirements under existing laws and regulations; an internal audit shall be conducted at least once every two years.
  5. The confidentiality and integrity of NTHU's information assets shall be properly protected, and an information asset inventory and a risk assessment shall be conducted at least once a year.
  6. To ensure the continuous operation of NTHU's information business services, business continuity plan drills shall be performed on all core information and communications systems once every two years.
  1. Qualitative Metrics
  1. To ensure effective information security, NTHU's cyber security maintenance plan shall be regularly reviewed. Proper training on information security should be provided, subject to the duties and responsibilities of the employees, in order to comply with the requirements set forth by the competent authority.
  2. Strengthen the environmental security of NTHU's information computer room and facilities, and adopt proper protection and authority control mechanisms.
  3. Strengthen access control in order to prevent unauthorized improper access and to ensure that NTHU's information assets are under proper protection.
  4. Ensure that no information will be disclosed to any unauthorized third parties during the transfer process or due to accidental actions.
  5. Ensure that all information security incidents and susceptible security weaknesses are reported upward via proper notification mechanisms, and are properly investigated and handled.

III.   Approval Procedures for the Information Security Policy and Goals
The Information Security Policy and Goals are approved by the Information Security Officer of NTHU. The head of each unit shall be responsible for monitoring and maintaining compliance with the Information Security Policy and relevant guidelines.

IV.   Promotion of the Cyber Security Policy and Goals

  1. NTHU's Information Security Policy and goals shall be made known annually to all personnel of NTHU through education training, internal meetings, announcements and so on. The performance of the aforesaid work shall be reviewed.
  2. NTHU shall annually disseminate the Information Security Policy and goals to interested parties (e.g., IT service providers and units in charge of agency connection works). The performance of the aforesaid work shall be reviewed.

V.    Regular Review Procedures for the Information Security Policy and Goals

  1. To ensure the continuous operation of NTHU's information system, the Information Security Policy shall be updated at least once a year to reflect the latest developments in governmental regulations, technologies and businesses.
  2. The adequacy of the Information Security Policy shall be periodically reviewed at the review meetings of the information security and personal data protection management.