What is the CISO of a listed company in Taiwan responsible for?

Under the TWSE and TPEx Cybersecurity Control Guidelines for Listed Companies, Article 3 requires a cybersecurity promotion organisation with a dedicated cybersecurity head and staff; Article 34 requires incident response and reporting procedures; Article 37 requires regular reporting on cybersecurity to the board or management. Under Article 41, listed companies may adopt the guidelines as appropriate to their industry, size and cybersecurity risk; companies that are not public companies are not covered.

Must a listed company in Taiwan appoint a CISO?

Under the FSC order of 28 December 2021 (issued under Article 9-1(2) of the internal control regulations), listed companies with paid-in capital of NT$10 billion or more, Taiwan 50 constituents or e-commerce companies above set revenue thresholds had to appoint a chief information security officer by the end of 2022 and set up a dedicated unit with a head and at least two staff; other listed companies (except those with three consecutive years of pre-tax losses or net worth per share below par) had to have a dedicated head and at least one staff member by the end of 2023. The official rules set no rank for the CISO of an ordinary company.

Does ISO 27001 certification help in the TWSE ESG evaluation?

Yes. Indicator S-12 asks for a disclosed cybersecurity risk management framework, policy, concrete programmes and resources; implementing ISO 27001, CNS 27001 or a similar standard with third-party certification earns one extra point overall (2026 and 2027 indicators).

If we hold ISO 27001, are we compliant with NIS2, the CRA and GDPR?

No. None of them has a standalone certificate: NIS2 requires the Article 21 measures and Article 23 reporting; the CRA requires conformity assessment by product category and CE marking; GDPR compliance is shown through records of processing, DPIAs, processor contracts, transfer mechanisms and notification records. 27001 is the shared management backbone that shortens the other projects.

How fast do EU laws require us to report a security incident?

GDPR: within 72 hours of awareness. NIS2: early warning within 24 hours, notification within 72 hours, final report within one month. DORA: initial notification within 4 hours of classification as major and no later than 24 hours from awareness. EU CRA, for actively exploited vulnerabilities and severe incidents: early warning within 24 hours, notification within 72 hours. One incident can trigger several.

We are only a supplier to EU customers. Do NIS2 and DORA reach us?

Regulated NIS2 entities write supply chain security requirements into their contracts. DORA applies directly to EU financial entities; a Taiwanese SaaS, cloud or security provider serving them must meet the contract clauses on audit rights, data portability, business continuity and exit strategy and support the customer's Register of Information.

A vulnerability is found in our product. What process does the CISO need?

Externally, ISO/IEC 29147 for receiving reports and publishing advisories; internally, ISO/IEC 30111 for verification, rating and remediation; then the EU CRA Article 14 reporting: for actively exploited vulnerabilities, early warning within 24 hours and notification within 72 hours.

A carmaker requires TISAX. Do we also need ISO/SAE 21434?

Usually yes, if you develop or supply cybersecurity-relevant automotive E/E systems, components or software. TISAX assesses information security at company sites; 21434 governs the product cybersecurity engineering process; one cannot replace the other, and the actual requirement follows the carmaker's request for quotation and contract.

Which version of ISO 27001 should we use now?

ISO/IEC 27001:2022; the transition period for 2013-version certificates ended on 31 October 2025. Organisations on the old version do not start over: they map controls and close the gaps.

We have started using AI. Should the CISO pursue ISO 42001?

If customers or markets want proof of AI governance, ISO 42001 is a certifiable management system standard that shares its structure with 27001 and 27701; organisations with 27001 usually reach certification in 4–6 months. The certificate is not EU AI Act compliance.

Which standards and laws does a CISO own? 12 requirements explained one by one

Direct answer: in Taiwan the CISO has a defined role in corporate governance. Under Article 9-1 of the Regulations Governing Establishment of Internal Control Systems by Public Companies, every public company must allocate adequate staff and equipment to plan, monitor and carry out information security management; listed companies that meet the conditions set by the Financial Supervisory Commission (FSC) must appoint a chief information security officer and a dedicated security unit; the annual report must disclose cybersecurity management; and the TWSE ESG evaluation includes a cybersecurity indicator. A CISO also owns more than ISO 27001. Depending on what the company sells, where it sells and who its customers are, three kinds of requirement land on the CISO: EU laws with statutory reporting deadlines (GDPR, NIS2, DORA, the EU CRA); assessments and certifications required by customers or the industry (TISAX, ISO/SAE 21434, IEC 62443, ISO/IEC 29147 and 30111); and management systems that extend into privacy, business continuity and AI (ISO 27701, ISO 22301, ISO 42001). The CISO's job is to determine which ones really apply, then answer several of them with one body of risk assessment, incident response, supplier management and audit evidence. Two things to remember: GDPR, NIS2, DORA and the EU CRA have no standalone certificate, and an ISO certificate is not legal compliance.

The CISO in corporate governance: first see which tier your company is in

Who	Rule	Requirement
All public companies	Regulations Governing Establishment of Internal Control Systems by Public Companies, Article 9-1	Allocate adequate staff and equipment to plan, monitor and carry out information security management; where the FSC's conditions are met, the FSC may order the company to designate the person in charge of information security policy and resources as chief information security officer and to set up a dedicated unit, head and staff
Listed companies with paid-in capital of NT$10 billion or more, Taiwan 50 constituents, or e-commerce revenue above set thresholds	FSC order of 28 December 2021 (Jin-Guan-Zheng-Shen No. 11003656544)	By the end of 2022, appoint a chief information security officer and set up a dedicated unit with a head and at least two dedicated staff
Other listed companies (except those with pre-tax losses in each of the last three years or net worth per share below par)	Same order	By the end of 2023, have a dedicated information security head and at least one dedicated staff member; companies that qualify later adjust within six months
Listed companies	TWSE and TPEx Cybersecurity Control Guidelines for Listed Companies	Security organisation and dedicated head (Art. 3), security policy approved by a vice-president or above and reviewed regularly (Art. 4), incident response and reporting (Art. 34), joining an information-sharing organisation (Art. 35), regular reporting to the board or management (Art. 37), regular internal and vendor security audits (Art. 38), annual report disclosure (Art. 39)
Annual reports of public companies	Regulations Governing Information to be Published in Annual Reports of Public Companies, Article 18, item 6	Disclose the cybersecurity risk management framework, policy, concrete programmes and resources invested, and the losses, possible effects and responses for major cybersecurity incidents
Banks and financial holding companies	Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries, Article 24	A vice-president or above, or a person of equivalent responsibility, serves as chief information security officer and reports to the board each year on the previous year's information security

For ordinary public and listed companies, the official rules set no rank for the CISO; "vice-president or above" is a requirement for banks, financial holding companies and the securities and futures sector. Companies that are not public companies are not covered by these rules and can use them voluntarily.

TWSE ESG evaluation: indicators the CISO prepares

The ESG evaluation replaced the corporate governance evaluation from 2026 and covers listed companies. The indicators below have the same wording in the 2026 and 2027 editions.

Indicator	Content	Bonus
S-12	Has the company built and disclosed a cybersecurity risk management framework, policy, concrete programmes and the resources invested (assessed from the annual report)	One extra point overall for implementing ISO 27001, CNS 27001 or an equivalent or stronger system or standard with third-party certification
S-13	Has the company set a personal data protection policy and disclosed its content and implementation	—
S-15	Has the company disclosed a supplier management policy requiring suppliers to follow rules on occupational safety and health, labour rights, information and communication security or privacy, and explained its implementation	—

The 12 requirements at a glance

Requirement	What it means for the CISO	Is there a certificate?
ISO 27001	The backbone of the security management system; most other requirements can hang on it	Yes, third-party certification
ISO 27701 / GDPR	72-hour personal data breach notification; a 27701 certificate is not GDPR compliance	27701 yes; GDPR has no official certificate
NIS2	Minimum security measures and incident reporting for regulated entities; suppliers take it on through contracts	No
DORA	ICT risk of EU financial entities; ICT service providers take it on through contracts	No
EU CRA	Vulnerability handling and reporting for digital products	No standalone certificate; conformity assessment by product category, then CE marking
ISO/IEC 29147	External: receiving vulnerability reports and publishing advisories	Does not create a CRA presumption of conformity
ISO/IEC 30111	Internal: process and records for verifying, rating and fixing vulnerabilities	What matters is an auditable process and records
IEC 62443	Security of industrial control and OT products and systems	Yes, third-party certification; not a presumption of CRA conformity
TISAX	Carmakers assess the information security of supplier sites	An assessment and exchange mechanism, not an ISO certificate
ISO/SAE 21434	Cybersecurity engineering process for automotive E/E products	The standard itself has no official certification scheme
ISO 22301	Business continuity and ICT recovery	Yes, third-party certification
ISO 42001	Governance of the AI the company uses and builds	Yes; not EU AI Act compliance

Statutory reporting deadlines: the first numbers a CISO puts into the response procedure

Law	Trigger	Deadline
GDPR Article 33(1)	Personal data breach (unless unlikely to result in a risk)	Without undue delay and, where feasible, within 72 hours of becoming aware, to the supervisory authority
NIS2 Article 23(4)	Significant incident	Early warning within 24 hours, incident notification within 72 hours, final report within one month of the notification
DORA Article 19 with Delegated Regulation (EU) 2025/301 Article 5	Major ICT-related incident	Initial notification within 4 hours of classification as major and no later than 24 hours from awareness; intermediate report within 72 hours of the initial notification; final report within one month of the latest intermediate report
EU CRA Article 14	Actively exploited vulnerability; severe incident affecting product security	Through ENISA's single reporting platform: early warning within 24 hours, notification within 72 hours; applies since 11 September 2026, including products already on the EU market

One incident can trigger several of these at once, each with its own starting point and receiving authority. The response procedure should list all four side by side and decide which apply in a single incident classification step.

Requirement by requirement: what the CISO decides, what can be shared, how long it takes

ISO 27001 information security management system

Decide first: the certification scope required by customers, tenders and regulators.
Version: implement ISO/IEC 27001:2022; the transition period for 2013-version certificates ended on 31 October 2025.
Where the audit focuses: the risk assessment and the Statement of Applicability. Not all 93 controls have to be implemented; applicability follows the risk assessment, and exclusions are justified.
Timeline (as listed on the service page): typically 4–8 months: gap analysis, system build, internal audit and management review, then stage 1 and stage 2 certification.
What it shares: the NIS2, ISO 22301, ISO 42001 and ISO 27701 timelines below are all shorter when 27001 is already in place.
Go deeper: ISO 27001 consulting, Which ISO 27001 consultant in Taiwan?, Outsourcing the ISO 27001 internal audit

ISO 27701 and GDPR

Decide first: whether the company offers goods or services to people in the EU or monitors the behaviour of people in the EU; either one brings it under the GDPR.
Limits of the certificate: ISO/IEC 27701:2025 was published on 14 October 2025 and can be certified without 27001; but the Article 27 EU representative, the choice of SCC module and whether a DPIA is mandatory are legal judgements 27701 does not make.
The CISO's part: a 72-hour breach notification that actually works, with drill records.
Timeline (as listed on the service page): baseline GDPR compliance usually takes 2–3 months; with ISO 27701 certification 5–8 months, shortened to 3–5 months with 27001 already in place.
Go deeper: ISO 27701, GDPR, Choosing an ISO 27701 consultant

NIS2 Directive

Decide first: by size and Annexes I and II, whether the company is an essential or important entity, and what its Member State requires. A supplier to a regulated entity gets supply chain security requirements written into its contracts.
What has to be in place: the ten minimum measures of Article 21, the reporting deadlines of Article 23, and approval and oversight by the management body (Article 20).
Timeline (as listed on the service page): usually 4–6 months from gap analysis to a working system; 2–3 months with ISO 27001 already in place.
Go deeper: NIS2, Choosing a NIS2 consultant

DORA Digital Operational Resilience Act

Decide first: whether the company is an EU financial entity or an ICT provider serving one. DORA has applied since 17 January 2025 and applies directly to the EU financial entities listed in Article 2(1).
What an ICT provider does: meet the contract clauses on audit rights, data portability, business continuity and exit strategy, and supply service information for the customer's Register of Information.
Timeline (as listed on the service page): preparing an ICT provider's contractual obligations usually takes 2–3 months; a full framework for a financial institution usually 6–9 months.
Go deeper: DORA, Choosing a DORA consultant

EU Cyber Resilience Act (CRA)

Decide first: whether the product is in CRA scope, which category it falls into and which conformity assessment route applies. Default products can use internal control (module A); important class I products without full use of harmonised standards, class II and critical products need a third-party procedure.
Dates: the Article 14 reporting obligations have applied since 11 September 2026; the other main obligations apply in full from 11 December 2027.
The CISO's part: the vulnerability handling process required by Annex I, the SBOM, the Annex VII technical documentation and the Article 14 reporting process.
Go deeper: EU CRA compliance, Who leads CRA, CRA timeline, CRA budget

ISO/IEC 29147 vulnerability disclosure

What it means for the CISO: the external entry point for vulnerability reports and the advisory process. The CRA does not name ISO/IEC 29147; it requires outcomes: a CVD policy, a contact address for reports, remediation, and public information on fixed vulnerabilities once a security update is available.
Typical deliverables: security.txt and a reporting mailbox or form, intake and response SLAs, a CVD policy with a safe harbour statement, advisory templates and a publishing process.
What it shares: with 27001 in place, the CVD process can hang on the existing ISMS, sharing documents and audits.
Go deeper: ISO/IEC 29147, Choosing a 29147 consultant

ISO/IEC 30111 vulnerability handling

What it means for the CISO: write down who receives, verifies, rates, fixes and publishes, and how fast, as an auditable process with SLAs, linked to incident response (ISO/IEC 27035) and supplier management (ISO/IEC 27036).
Link to the CRA: in the JRC and ENISA mapping, 30111 covers five of the eight vulnerability handling items in Annex I Part II of the CRA; the SBOM, regular testing and secure distribution of updates must be covered by other standards or procedures.
Recommendation: implement it together with 29147 so the hand-off leaves no audit gap.
Go deeper: ISO/IEC 30111, Choosing a 30111 consultant

IEC 62443 industrial control system security

Decide first: the smallest set of parts the company needs for its role and goals, so it does not pay for certifications it does not need.
Order: before a 4-2 product certification, the organisation must complete 4-1 secure development lifecycle (SDL) certification. IEC 62443 certification is not a presumption of CRA conformity; that comes only from harmonised standards published in the Official Journal, common specifications or designated certification schemes (CRA Article 27).
Timeline (as listed on the service page): 4-1 SDL organisational certification usually 6–9 months; 4-2 product certification 4–8 months (excluding 4-1); 2-1 management system 4–6 months; 2-4 service provider certification 3–5 months.
Go deeper: IEC 62443, Choosing an IEC 62443 consultant

TISAX automotive information security assessment

Decide first: the assessment scope, objectives and level, and whether VDA ISA 6 or ISA2027 applies. The level follows the assessment objectives and cannot be chosen freely; AL2 is usually done by video, AL3 requires the auditor on site. Assessments commissioned from 1 January 2027 all use VDA ISA2027.
Limits of the label: TISAX is an assessment and exchange mechanism run by ENX; results are shared with carmakers as labels on the ENX platform and are valid for 3 years.
Timeline (as listed on the service page): usually 7–12 months or more, shorter with ISO 27001 in place.
Go deeper: TISAX assessment consulting, Choosing a TISAX consultant, TISAX timeline

ISO/SAE 21434 automotive cybersecurity engineering

What it means for the CISO: TISAX assesses information security at company sites; 21434 governs how products are developed securely. Passing TISAX does not show 21434 capability.
Core work: TARA (threat analysis and risk assessment), from which cybersecurity goals and requirements are derived and carried through development and verification. Organisations with ASPICE or ISO 26262 processes can add 21434 incrementally to the existing development framework.
Limits of certification: the standard itself has no official certification scheme; what matters more is passing the carmaker's development audits.
Go deeper: ISO/SAE 21434, Choosing a 21434 consultant

ISO 22301 business continuity management

What it means for the CISO: ICT recovery and disaster recovery need RTOs derived from a BIA, and exercise records. A BCP alone is not enough: without a BIA and exercise records, the plan effectively does not exist in audits and customer reviews.
What it shares: backup and ICT recovery documents with 27001; exercise records also serve as certification and customer questionnaire evidence.
Timeline (as listed on the service page): four phases, usually 4–7 months; about 3–5 months with 27001 in place. The BIA and the exercises cannot be compressed.
Go deeper: ISO 22301, Choosing an ISO 22301 consultant, ISO 22301 budget and timeline

ISO 42001 AI management system

What it means for the CISO: once the company uses or builds AI, the AI system inventory and the risk and impact assessment need to come under governance.
Limits of the certificate: ISO/IEC 42001:2023 certificates are issued by certification bodies accredited under ISO/IEC 42006; but EU AI Act conformity assessment, EU database registration, an authorised representative and Article 50 transparency remain legal procedures a certificate cannot replace.
What it shares: with ISO 42001 as the management system base, it shares its structure with 27001 and 27701.
Timeline (as listed on the service page): organisations with ISO 27001 usually reach certification in 4–6 months; from scratch about 6–9 months.
Go deeper: ISO 42001 consulting, Choosing an ISO 42001 consultant, ISO 42001 with 27001 and 27701

How it fits the systems you already have

Listed companies in Taiwan already have the organisation and procedures required by the TWSE and TPEx Cybersecurity Control Guidelines for Listed Companies, and new requirements should be folded into them rather than built as a second system. Under Article 41, listed companies may adopt the guidelines as appropriate to their industry, size and cybersecurity risk; companies that are not public companies are not covered by these guidelines and can use them voluntarily.

Guideline article	What you already have	How the new requirements fold in
Article 3: set up a cybersecurity promotion organisation and appoint a dedicated cybersecurity head and staff	The security organisation and its head	NIS2 Article 20 requires the management body to approve and oversee security measures; write NIS2, DORA and CRA responsibilities into the same organisation
Article 34: set incident response and reporting procedures	Response and reporting procedures for the company's own information systems	List the four EU reporting deadlines and receiving authorities above in the same procedure. Article 34 covers the company's own systems; CRA product vulnerability reporting must be connected separately to the product vulnerability handling process (ISO/IEC 30111)
Article 37: report regularly on cybersecurity to the board or management	Regular security reporting	Put the applicability decisions, reporting drills and audit results for every requirement into the same report

How Winners Consulting works

This is Winners Consulting's own description; hold us to the questions above, just as you would any other consultant.

Who leads: vice-president and director-level consultants personally lead the work end to end, never outsourced; the team holds ISO lead auditor qualifications
Applicability first: we confirm the security requirements of customers, tenders and regulators, determine which laws and standards really apply, then set the scope
One body of evidence: ISO 27001 as the backbone, with ISO 27701, 22301 and 42001 sharing the management system; 29147 and 30111 implemented as a pair
Division of work: certification is carried out by an independent certification body; we accompany you and do not audit on its behalf
First step: the first mechanism diagnosis is free

Which named clients has Winners served in ISO 27001 ISMS Consulting & Certification?

Hypercore Fitness Center
ISO 27001 ISMS and ISO 27701 PIMS dual-certification consulting
Read the full case →
卓元科健 (Cho Yuan)
ISO 27001 ISMS and personal data protection consulting
Joint Credit Information Center (JCIC)
Internal control system integrated with ISO 27001 and TPIPAS
Taiwan Stock Exchange (TWSE)
Internal control system integrated with ISO 9000 and ISMS
訊光資訊科技 (InfoLight)
ISO 27001 ISMS consulting
MPI Corporation (旺矽科技)
ISO 27001 ISMS and trade secret protection consulting

Other engagements are anonymised by industry under NDA.

Compliance needs all three; a consultant's value is integration

CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.

Dimension	The question it answers	Typical gap when only this part is done
Process (management system)	Who is responsible, what is done, when, where the evidence is, how it improves	Tools are in place but nobody runs them on schedule, so there are no records at audit time
Security technology	How controls are designed and how their effectiveness is verified	Documents are complete but the systems do not actually do what they describe
Legal compliance	Which regulation applies, which role you hold, the deadlines and penalties	Controls are built against the wrong regulation or role, so obligations are not covered

Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.