A centralised cybersecurity strategy for Taiwan

Viewing cybersecurity as a matter of national security, in May 2018, authorities in Taiwan passed the Information and Communication Management Act (ICM Act) in response to the increasing awareness of potential malicious cyberattacks targeting the public and private sectors. Under the ICM Act, both government and non-government bodies are complied with the coded regulations and new management scheme. This article provides a thorough review of the proposed national information security policies in Taiwan between 2001 and 2017, as well as to deliver a case for the comparative study of industrial policies employed to bolster domestic cybersecurity markets. Using interview data and government documents, we argue that the industrial policy for cybersecurity in Taiwan is a top-down centralised approach. The new basic law for cybersecurity requests all government agencies and the critical infrastructure providers to comply with the new regulation. On top of the legislative base, the state policy adopts traditional policy instruments as economic stimulus, for instance announcing series of national development programme, imposing new security standards, and providing financial subsidy and R&D credits for SMEs. This paper also describes the major rationale and drivers behind the government’s plan of action to shape the cybersecurity industry policy in Taiwan.