【Taiwan】Cybersecurity skills training development blueprint followed by Taiwan's public sector台灣公部門依循的資安職能訓練發展藍圖

Cybersecurity skills training development blueprint followed by Taiwan's public sector

Cybersecurity Education and Training

• I. Development Blueprint for Cybersecurity Functional Training

To strengthen dedicated cybersecurity human resources and cultivate cybersecurity capabilities within government agencies, this agency promotes a cybersecurity skills training development blueprint, regularly training cybersecurity personnel from various agencies to assist dedicated cybersecurity personnel in government agencies in developing the necessary professional capabilities to meet the requirements of the "Cybersecurity Responsibility Level Classification Method" for cybersecurity education and training. The following matters are handled:

For information on cybersecurity skills training and related information, please visit the Cybersecurity Skills Training Service Website ( https://ctts.nics.nat.gov.tw/ ) or the Cybersecurity Skills Training Course Introduction ( https://ctts.nics.nat.gov.tw/DownloadDetail/68 ).

• (i) Develop training materials for cybersecurity functions and provide them to training institutions for implementation.
• (ii) Organize a series of seminars on cybersecurity protection and conduct publicity on cybersecurity policies and threats.
• (iii) Establish a cybersecurity assessment question bank, with cybersecurity experts creating and reviewing the questions to improve the effectiveness of the assessment.
• (iv) Organize a series of cybersecurity competitions to discover potential cybersecurity talents and improve cybersecurity attack and defense skills.
• (v) Establish a cybersecurity talent database to understand the allocation of cybersecurity personnel in government agencies.
• II. Cybersecurity Dedicated Human Resources Functions

Cybersecurity professionals are required to possess the following capabilities based on their job responsibilities: strategic, managerial, and technical. These capabilities are further categorized into two levels : core competencies and professional competencies. Core competencies refer to basic knowledge of cybersecurity and its regulations. Professional competencies are defined according to the strategic, managerial, and technical aspects. Strategic competencies include capabilities in cybersecurity strategy planning, business review, resource coordination, and performance evaluation. Managerial competencies include capabilities in cybersecurity mechanism planning, management and maintenance, risk assessment, maintenance management, and business auditing. Technical competencies include capabilities in network management, incident handling, cybersecurity testing, software / system management, and intelligence analysis.

Cybersecurity Specialist Human Resource Functions and Required Capabilities

• III. Cybersecurity Governance System

To implement the cybersecurity governance system for government agencies, enhance cybersecurity preparedness, and establish objective indicators to strengthen the objectivity of assessments, the government has undertaken the following tasks:

Cybersecurity Governance Maturity Architecture

• (a) Establish an objective indicator verification project for the maturity of cybersecurity governance in government agencies, and hold briefing sessions on the maturity assessment mechanism for each agency.
• (ii) Cooperate with the cybersecurity service team to complete the training courses, conduct on-site training at government agencies, provide consulting services, and assist agencies in achieving their cybersecurity goals.
• (iii) Update the content of the inspection items and system functions based on the feedback and evaluation opinions of the training course, and understand the cybersecurity protection situation based on the maturity assessment results.
• IV. Promote the addition of information and communication security-related subjects to civil service examinations.

In response to the increasingly severe threat of cybersecurity and hacking, government agencies urgently need cybersecurity professionals to implement and improve various cybersecurity protection measures. To alleviate the demand for cybersecurity personnel, this agency, together with the Examination Yuan and the Directorate-General of Personnel Administration of the Executive Yuan, has added a "Cybersecurity" category to the civil service examination. Recruitment has been conducted since 2024. The examination content is designed based on the core functions and professional capabilities required of cybersecurity professionals, including four professional subjects: "Introduction to Cybersecurity," "Cybersecurity Management," "Cybersecurity Protection Technology," and "Cybersecurity Laws and Regulations." The aim is to provide agencies with a more stable source of cybersecurity personnel by expanding recruitment channels, so as to cope with rapidly changing technological and business challenges and strengthen the overall cybersecurity protection capabilities of agencies.

The civil service examination will add a subject related to information and communication security.

資安教育訓練

• 一、資安職能訓練發展藍圖

為強化資安專職人力資源，蘊育機關資安能量，本署推動資安職能訓練發展藍圖，定期調訓各機關資安（訊）人員，藉以協助公務機關資安專職人員建立所需之專業能力，以符合「資通安全責任等級分級辦法」之資通安全教育訓練應辦事項要求，辦理下列事項：

資安職能訓練發展藍圖有關資安人才培訓相關資訊內容請連結至資安人才培訓服務網（網址：https://ctts.nics.nat.gov.tw/），資安職能訓練課程簡介（網址：https://ctts.nics.nat.gov.tw/DownloadDetail/68）

• （一）開發資安職能訓練課程教材，提供各訓練機構執行訓練業務。
• （二）辦理資通安全防護巡迴研討會，進行資安政策、資安威脅宣導。
• （三）建立資安評量題庫，由資安專家命、審題，提升評量有效性。
• （四）辦理資安系列競賽，挖掘潛在資安人才，提升資安攻防技能。
• （五）建置資安人才資料庫，掌握公務機關資安人力配置情形。
• 二、資安專職人力職能

資安專職人力職能，依其業務職掌分為策略面、管理面及技術面3個面向之應備能力，並定義2層次應備資安職能包含核心職能與專業職能。核心職能係指具備資通安全基本認知及資通安全法規認知；專業職能則依策略面、管理面及技術面分別有其專業職能能力，策略面包括具資安策略規劃、業務審查、資源協調、績效管考等能力；管理面包括資安機制規劃、管理維運、風險評估、維運管理、業務稽核等能力；技術面包括網路管理、事件處理、資安檢測、軟體/系統管理、情資分析等能力。

資安專職人力職能與應備能力

• 三、資安治理制度

政府為落實政府機關資安治理制度，提升資安防護整備，並建立客觀指標，以強化評估之客觀性，辦理下列事項：

資安治理成熟度架構

• （一）建立政府機關資安治理成熟度客觀指標檢核項目，針對各機關辦理成熟度評估機制說明會。
• （二）配合資安服務團完成輔導訓練課程，並至機關進行實地輔導作業，提供諮詢服務，協助各機關達成資安目標。
• （三）依訓練課程回饋與評估意見，更新檢核項目內容與系統功能，就成熟度評估結果，了解資安防護情形。
• 四、推動公務人員考試增設資通安全類科

因應資安駭侵威脅日益嚴峻，政府機關亟需資安專業人才落實精進各項資安防護工作，為紓解資安人力成長需求，本署偕同考試院與行政院人事行政總處推動公務人員考試增設「資通安全」類科，自113年起開始招考，考試內容依資安專職人員所需之核心職能及專業能力規劃設計，包含「資通安全概論」、「資通安全管理」、「資通安全防護技術」及「資通安全法令與規範」等4門專業科目，期透過擴大取才管道，提供機關更穩定的資安人力來源，以應對快速變化的技術與業務挑戰，強化機關整體資安防護能量。

公務人員考試增設資通安全類科