This Act is enacted for the establishment of the National Institute of Cyber Security（hereinafter referred to as “the Institute”）to enhance the nation’s cyber security technology competence, and promote the research, development, and application of cyber security technology.

The Institute shall be a non-departmental public body. The Ministry of Digital Affairs shall be its supervisory authority.
The Ministry of Digital Affairs may commission or designate an agency to supervise the Institute’s operation.

The Institute’s scope of operation shall include:
1. researching and developing cyber security technology, and promoting the application, technology transfer, industry-university collaboration services, and international cooperation and exchanges of cyber security technology;
2. assisting in planning and promoting national cyber security protection mechanisms;
3. assisting government agencies（or institutions）and critical infrastructure in responding to major cyber security incidents;
4. assisting in planning and supporting of the cyber security protection of nation’s critical infrastructure;
5. assisting in planning and fostering cyber security talents, and promoting cyber security awareness nationwide;
6. supporting government agencies or institutions in cyber security protection operations with special sensitivity;
7. supporting demands for the industry’s major development in cyber security and its regulatory initiatives; and
8. other matters related to cyber security technology.

The Institute’s sources of funding shall include:
1. budgets approved and allocated by the government, and donations or subsidies from the government;
2. domestic or overseas donations from public or private institutions, civil associations, and individuals;
3. revenue from commissioned research and provision of services; and
4. other revenue.
The donations specified in subparagraph 2 of the preceding paragraph shall be deemed to be the donations to the government.

The Institute shall prescribe its bylaws along with rules and regulations governing the management of personnel, accounting system, internal control, auditing and others related matters, which shall be adopted by its board of directors and filed to the supervisory authority for future reference.
The Institute may, without contravening any related laws or regulations, prescribe rules and regulations concerning its execution of public affairs, which shall be adopted by its board of directors and filed to the supervisory authority for future reference.

When engaging in cyber security operations with special sensitivity, government agencies may carry out procurements pursuant to subparagraph 3, paragraph 1, Article 105 of the Government Procurement Act. In such case, the Institute shall be deemed to be a government institution and the Ministry of Digital Affairs shall be deemed to be its superior authority.

The Institute shall have a board of directors consisting of not less than seven nor more than eleven directors. The directors shall be nominated by the supervisory authority and appointed by the premier of the Executive Yuan. In the event of the removal, the same procedure shall be followed. The directors shall be nominated among the following people:
1. representatives of related government agencies; among them, the representatives nominated by the National Security Council and Ministry of National Defense, if any, shall be ex-officio directors; and
2. scholars and experts in the field of cyber security research, or disinterested citizen members who have made great contributions to cyber security.
The number of directors nominated from people specified in subparagraph 1 of paragraph 1 shall not be less than half of the total number of directors.
The number of directors specified in paragraph 1 of a given gender shall not be less than one-third of the total number of directors.

The Institute shall have not less than three nor more than five supervisors. The supervisors shall be nominated by the supervisory authority and appointed by the premier of the Executive Yuan. In the event of the removal, the same procedure shall be followed. The supervisors shall be nominated among the following people:
1. representatives of related government agencies; and
2. scholars and experts in the related fields of cyber security research, accounting, financial auditing, auditing, law, or finance.
A managing supervisor shall be elected among the supervisors.
The number of supervisors nominated from people specified in subparagraph 1 of paragraph 1 shall not be less than half of the total number of supervisors.
The number of supervisors specified in paragraph 1 of a given gender shall not be less than one-third of the total number of supervisors.

The term of office of each director or supervisor is three years. Directors or supervisors may be reappointed once upon the expiration of the original term of office.
The directors or supervisors acting on behalf of government agencies shall be replaced if their government positions are changed, and shall not be bound by the restriction on the times of reappointment specified in the preceding paragraph. If there is a vacancy in the position of directors or supervisors appointed pursuant to subparagraph 2, paragraph 1 of Article 7 and subparagraph 2, paragraph 1 of the preceding Article before the expiration of the term of office, the vacancy shall be filled by the nomination of the supervisory authority and the appointment of the premier of the Executive Yuan for the unexpired portion of the predecessor’s term.

The Institute shall have one chairperson of the board of directors, nominated by the supervisory authority among the directors, and appointed by the premier of the Executive Yuan. In the event of the removal, the same procedure shall be followed.
The chairperson shall be appointed pursuant to the regulations prescribed by the supervisory authority.
The chairperson is in charge of all affairs of the Institute internally, and represents the Institute externally as well. If the chairperson cannot exercise the authority for any reason whatsoever, the director designated by the chairperson shall act on behalf of the chairperson, but if the designation cannot be made, the person being elected by the directors among themselves shall act on behalf of the chairperson.
The chairperson may not exceed the age of sixty-five at the first term of office. If the chairperson reaches the age of seventy before the expiration of the term of office, the chairperson shall be replaced immediately. However, if there are special considerations that have been approved by the Executive Yuan, the aforementioned limitations shall not apply.

The board of directors shall have the following functions and powers:
1. reviewing development goals and plans;
2. reviewing annual operating plan;
3. reviewing annual budget and financial statements;
4. reviewing rules and regulations;
5. reviewing the disposition of or the creation of encumbrances over the Institute-owned real estates;
6. reviewing the matters required by this Act to be resolved by the board of directors;
7. appointing and removing the president of the Institute; and
8. reviewing other matters of material importance.

The meeting of the board of directors shall be held once every three months. If necessary, a special meeting may be convened and presided over by the chairperson.
The meeting of the board of directors shall be attended by more than half of the directors, and its resolution shall be adopted upon the approval of more than half of the directors present at the meeting. However, the resolution on any matter specified in subparagraphs 1 to 7 of the preceding Article shall be adopted upon the approval of more than half of the total number of the directors.

The supervisors shall have the following functions and powers:
1. examining and approving annual financial statements;
2. supervising operational status and finances;
3. auditing financial accounts and documents as well as information of assets; and
4. examining and approving or auditing other matters of material importance.
Each supervisor shall exercise the functions and powers independently. The managing supervisor shall attend the meeting of the board of directors on behalf of all supervisors.

A director or supervisor shall not be a spouse or relative by blood or marriage within three degrees of consanguinity to another director or supervisor.

Matters related to the recusal due to conflicts of interest of the directors, supervisors, president, and their related persons shall comply with the Act on Recusal of Public Servants Due to Conflicts of Interest.
Those who are not in compliance with the preceding paragraph shall be liable for damages caused thereby to the Institute.
Where the persons specified in paragraph 1 are in contravention of the Act on Recusal of Public Servants Due to Conflicts of Interest, in addition to the penalties imposed pursuant to the aforesaid Act, the supervisory authority may also take appropriate action as stipulated in the regulations prescribed by the supervisory authority.

The directors and managing supervisor shall attend the meetings of the board of directors in person and shall not have another person attend the meeting on his or her behalf by proxy.

The chairperson of the Institute may be a full time or part time position. Compensation for the full time chairperson shall be approved by the supervisory authority. There shall be no compensation for the part time chairperson.
The directors, managing supervisor, and supervisors of the Institute shall all be uncompensated positions.

A person to whom any of the following circumstances applies shall not be appointed as a director or supervisor:
1. having been subject to the order of the commencement of guardianship or assistantship where such order has not been revoked yet;
2. having been sentenced to imprisonment for a definite period of time or a more severe punishment by the court’s final decision without probation;
3. having been adjudicated bankrupt or subject to the commencement of the liquidation process as ruled by a court pursuant to the Consumer Debt Clearance Act, and whose rights and privileges have not been reinstated;
4. having been deprived of civil rights and not yet been reinstated; or
5. having failed to pass the security vetting specified in Article 21 of this Act or refused to be vetted.
A director or supervisor who has one of the circumstances specified in the preceding paragraph, or fails to attend meetings of the board of directors for three consecutive times without justified reasons, shall be removed.
A director or supervisor to whom any of the following circumstances applies may be removed:
1. where misconduct or poor character has been proven detrimental to the image of the Institute;
2. where work has been performed unsatisfactorily or duties have been neglected with supporting details, or so as to constitute a material breach of the employment contract;
3. where the Institute has not met the standards laid out by the supervisory authority for its annual performance evaluation two years in a row;
4. where there has been a proven contravention of the Civil Service Administrative Neutrality Act;
5. where there has been proven lobbying or favors concerning matters under the individual’s purview, or where an individual has used his or her official capacity to accept special treatments or gifts such that the public interest or the interests of the Institute have been harmed;
6. where it is proven that the Institute’s property has been used for other than official use;
7. where it is proven that an individual has not comply with the stipulation of Article 14 or paragraph 1 of Article 15 concerning recusal in a case of conflict of interest; or
8. other conduct unbecoming a director or supervisor.
For any of the circumstances specified in the subparagraphs of the preceding paragraph, the supervisory authority shall give the accused the opportunity to state his or her opinions and appeal the charges before the removal.
Regulations concerning the appointment, removal, and replacement of the directors and supervisors of the Institute, as well as related matters, shall be prescribed by the supervisory authority.

There shall be one president of the Institute, who shall have experience related to cyber security or management, to carry out the Institute’s operation and management. The president shall be nominated by the chairperson and hired upon approval by the board of directors. The same procedure shall be followed for the president’s removal. The president shall carry out the Institute’s operation and supervise all employees in accordance with the rules and regulations of the Institute and resolutions of the board of directors, and under the authority of the chairperson.
The president may not exceed the age of sixty-five at the first term of office. If the president reaches the age of seventy before the expiration of the term of office, the president shall be replaced immediately. However, if there are special considerations that have been approved by the Executive Yuan, the aforementioned limitations shall not apply.
Stipulations concerning directors and chairperson of the board of directors, namely Article 14, paragraphs 1 to 4 of Article 18, paragraphs 2 and 3 of Article 20, and subparagraph 6 of Article 25, shall also apply mutatis mutandis, to the president of the Institute.

Personnel shall be hired to work at the Institute pursuant to its rules and regulations concerning personnel management of the Institute. They shall not be considered as public servants. Their rights and duties shall be stipulated in their contracts.
Persons having a spousal or other relationship within three degrees of consanguinity or affinity with directors or supervisors shall not serve in positions concerning general affairs, accounting, or personnel at the Institute.
The chairperson shall not appoint his or her spouse or a person within three degrees of consanguinity or affinity to work at the Institute.

Personnel of the Institute shall be subject to security vetting.
Regulations concerning the applicable personnel, procedures, criteria, appeals, and other matters to be complied with for the security vetting specified in the preceding paragraph, shall be prescribed by the supervisory authority in consultation with relevant agencies.

Except as otherwise provided by laws and regulations, current personnel of the Institute and the personnel within three years upon resignation shall obtain permission from the supervisory authority before leaving the country.
Regulations concerning the applicable personnel, evaluation criteria for applicant's involvement in handling classified information, application process, conditions for permission, procedures, revocation, and other matters to be complied with for the personnel specified in the preceding paragraph, shall be prescribed by the supervisory authority.

The Institute shall formulate and submit its development goals and plans, as approved by the board of directors, to the supervisory authority for approval.
The Institute shall formulate and file its annual operating plan and budget, as approved by the board of directors, to the supervisory authority for future reference.

Within two months after the end of the fiscal year, the Institute shall present its annual performance report and financial statements to a certified public accountant for auditing and attestation. These documents shall be reviewed by the board of directors. After being approved by all supervisors, they shall be submitted to the supervisory authority for future reference as well as to the audit authority.
The audit authority may audit the financial statements specified in the preceding paragraph. The audit results may be sent to the supervisory authority or other related authorities for any necessary action.

The supervisory authority shall have the following supervisory power over the Institute:
1. approving the development goals and plans;
2. approving or filing for future reference the Institute’s rules and regulations, annual operating plan and budget, annual performance report, and annual financial statements;
3. examining the Institute’s assets and finances;
4. evaluating operational performance;
5. rendering opinions on appointing and removing directors or supervisors;
6. taking necessary disciplinary action against any director or supervisor who is in violation of laws and regulations when performing business operations;
7. withdrawing, amending, revoking, requesting improvements within a given time, suspending execution, or otherwise rendering dispositions in the event the Institute is in violation of the Constitution, laws, or regulations;
8. approving the disposition of, or creation of an encumbrance on real property owned by the Institute; and
9. supervising other matters as prescribed by the law.

The supervisory authority shall invite representatives of relevant agencies, scholars, experts, and disinterested citizen members to evaluate the performance of the Institute. The selected scholars, experts, and disinterested citizen members shall not be less than one half of the total number of the people invited.
The number of evaluators in the preceding paragraph of a given gender shall not be less than one-third of the total number of evaluators.
Regulations concerning the methods, procedures, and other related matters of the performance evaluation specified in paragraph 1, shall be prescribed by the supervisory authority.
The criteria for the performance evaluation are as follows:
1. assessing the annual performance outcomes of the Institute;
2. measuring the operational performance and achievement rate of the Institute;
3. assessing the achievement rate of the annual self-financing percentage of the Institute;
4. making recommendations on the appropriation of funds to the Institute; and
5. other related matters.

The fiscal year adopted by the Institute shall be the same as that followed by the government.
The accounting system adopted by the Institute shall be in accordance with the relevant regulations governing the establishment of the accounting systems of non-departmental public bodies.
The Institute’s financial statements shall be audited and attested by a certified public accountant.

The supervisory authority may approve and disburse allocations by making adjustments within the original scope of the budget at the year of the establishment of the Institute without being subject to the stipulations of Articles 62 and 63 of the Budget Act.

Where the Institute’s operations require the use of public property, such property may be purchased by the Institute, or donated, leased, or provided for use free of charge by government agencies. In the case of the donation, Article 25 of the Land Act, Article 28 and 60 of the National Property Act, and other relevant stipulations governing the local government’s management of public property shall not be applicable.
Where the Institute purchases the public land pursuant to the preceding paragraph, the purchasing price shall be determined in accordance with the announced current land value. The price of constructional improvements shall be determined in accordance with its current value as assessed for that year by the taxation authority. Where no such assessment of current value available, the value shall be determined in accordance with the appraisal result made by the public property management authority.
Assets purchased by the Institute for purposes specified in connection with the budget allocated by the government shall be public property.
Except for public property leased or provided for use free of charge as set forth in paragraph 1 and the public property prescribed in the preceding paragraph, all property acquired by the Institute shall be the Institute’s own property.
For property provided for use free of charge as specified in paragraph 1 and public property as set forth in paragraph 3, the Institute shall be registered as the manager of the property. All profits generated from such property shall accrue to the Institute as income without being subject to the restrictions specified in paragraph 1 of Article 7 of the National Property Act and other relevant stipulations governing the local government’s management of public property. Regulations governing matters related to the management, use, and profits of such property shall be prescribed by the supervisory authority.
Where public property is no longer needed or useful for the intended purpose, the Institute shall transfer its managerial responsibility of the property to the public property management authorities.
Where the Institute decides that public real property acquired by donation is no longer needed, the Institute shall return the property to the donating agency and shall not dispose of such property at its own discretion.

The budget allocated by government agencies to the Institute must be in line with legal budgetary procedures and is subject to audit and supervision.
Where the budget allocated to the Institute, as specified in the preceding paragraph, is more than 50 percent of the annual budgetary income of the Institute in a given year, the supervisory authority shall submit an annual budgetary statement of the Institute to the Legislative Yuan for review and approval.
The Institute shall prescribe rules and regulations on income and expenditure management for the use and management of its own income, and shall file the rules and regulations to the supervisory agency for future reference.

Debt raised by the Institute shall be limited to self-liquidating loans, which shall be submitted to the supervisory authority for approval in advance. Where debt cannot be repaid by self-liquidation according to the outcome of budget implementation, the Institute shall promptly review the situation and propose improvement measures to the supervisory authority for approval.

The Institute’s procurement process shall be open and fair. Except for the procurements carried out pursuant to treaties and agreements concluded by the Republic of China or Article 4 of the Government Procurement Act, the Government Procurement Act shall not apply to all other procurements carried out by the Institute. The Institute shall prescribe rules and regulations governing its procurement process and submit them to the supervisory authority for approval.
If there are other laws governing the same procurement stipulated in Article 4 of the Government Procurement Act as specified in the preceding paragraph, such laws shall prevail.

Except as otherwise provided in the Classified National Security Information Protection Act and other relevant laws and regulations, all information related to the Institute shall be made available to the public pursuant to the Freedom of Government Information Act. The Institute shall voluntarily make its annual financial statements, operation information, and performance evaluation reports available to the public.
The supervisory authority shall submit an analysis report on the performance evaluation reports prescribed in the preceding paragraph to the Legislative Yuan for its reference. The Legislative Yuan may, as it deems necessary, require the head of the supervisory authority together with the chairperson of the board of director, president, or related managerial personnel of the Institute to report the operational status and answer questions.

A person objecting to an administrative disposition rendered by the Institute may file an administrative appeal to the supervisory authority pursuant to the Administrative Appeal Act.

Where it becomes impossible for the Institute to achieve its establishment goals due to a change in circumstances or poor performance, the supervisory authority shall apply to the Executive Yuan for the dissolution of the Institute, which shall be enforced upon the approval of the Executive Yuan.
Where the Institute is dissolved, the employment contracts of the Institute personnel shall be terminated and remaining assets shall be turned over to the Treasury. All remaining rights and obligations shall be assumed by the supervisory authority.

The implementation date of this Act shall be decreed by the Executive Yuan.