The rule comes from the required-actions tables of Taiwan’s Regulations on Classification of Cyber Security Responsibility Levels. It applies to government agencies and specified non-government agencies, and the hours differ by role: general staff, IT staff and dedicated security staff each have their own requirement.
The summary below follows the tables as amended in January 2026. The level and actions that apply to a given organization are those approved by its competent authority.
Training hours at a glance
For levels A, B and C, the hours are the same for government and specified non-government agencies:
| Role | Hours required | Type of training |
|---|---|---|
| General users and managers | At least 3 hours per person per year | General cybersecurity awareness training |
| IT staff other than dedicated security staff | At least 3 hours of professional or competency training every two years, plus at least 3 hours of general training every year | Professional or competency training plus general training |
| Dedicated security staff | At least 12 hours per person per year | Professional or competency training in cybersecurity |
- Level D: no requirement for dedicated security staff; the other two roles are the same as above
- Level E: the baseline is 3 hours of general training per year for general users and managers (the central competent authority may add requirements)
- Dedicated security staff must also hold valid cybersecurity certifications or competency training certificates
Who must comply?
The hours come from the Cyber Security Management Act, which covers government agencies and specified non-government agencies: under Article 3 as amended in 2025, these are critical infrastructure providers, state-owned enterprises, specified foundations, and government-controlled enterprises, organizations or institutions. Each organization’s responsibility level is approved by its competent authority.
Training must be completed within one year of the first approval or a change in level, and the same applies when staff change, so new or transferred employees must complete it within a year.
Should private companies follow it?
For companies outside the scope of the Act there is no statutory training hour requirement. In practice, it is often required in three places:
- Government contracts and outsourcing: contracts often require vendors to meet the agency’s security requirements, including staff training
- Customer supplier audits: large enterprises and financial institutions commonly ask for annual security training hours and completion rates
- ISO 27001: no set hours, but regular training and evidence of understanding are required (clauses 7.2 and 7.3, Annex A 6.3)
What records make the hours verifiable?
In an audit or inspection, the most common question is how many hours each person completed this year and on what. For every training, keep at least:
- Course name, type (general or professional) and hours
- Each person’s completion date, linked to the HR roster and their role category
- Sign-in and sign-out records for in-person sessions (to prove hours), and completion records for online courses
- Test scores or other evidence of understanding
- Tracking of new and transferred staff who must complete training within a year
The full flow
Turning the hour requirements into records you can produce at any time takes five steps:
-
1
Confirm your level and role categories
Confirm the responsibility level and place every person in one of three groups: general users and managers, IT staff, or dedicated security staff.
-
2
Plan the year’s courses
Schedule general and professional courses by role and work out the annual hours each group must reach.
-
3
Deliver and record hours
Record actual hours with sign-in and sign-out for in-person sessions and completion for online courses, then confirm understanding with a test.
-
4
Track gaps and staff changes
Check each quarter who is short of hours, and add new or transferred staff to a list for training within a year.
-
5
Export an annual hours report
Before an inspection or audit, export each person’s courses, hours, scores and completion dates.
Manage security training hours and evidence with LabLearn
LabLearn keeps online courses, in-person sign-in and sign-out, post-training tests and certificates in one system, tracks completion and failures by department, and exports audit reports and attendance sheet PDFs. Questions can be generated by AI from your own security policies and are published only after human review.
FAQ
How many hours of security training are required in Taiwan?+
Under the classification regulations, general users and managers need at least 3 hours of general training per year; IT staff other than dedicated security staff need at least 3 hours of professional or competency training every two years plus 3 hours of general training each year; dedicated security staff need at least 12 hours of professional or competency training per year.
Does the 3-hour rule apply to private companies?+
The Act covers government agencies and specified non-government agencies (critical infrastructure providers, state-owned enterprises, specified foundations, and government-controlled enterprises, organizations or institutions). Other companies have no statutory hours, but government contracts and supplier audits often require regular training, and many companies adopt 3 hours per person per year; ISO 27001 itself sets no hours.
How soon must new employees complete security training?+
The regulations require training within one year of the first approval or a change in level, and the same applies when staff change, so new and transferred employees should complete it within a year.
Do online courses count toward training hours?+
The regulations do not restrict the format; what matters is proof of the hours and content completed. Keep completion and test records for online courses, and follow any specific rules your competent authority sets.
Does ISO 27001 set training hours?+
No. ISO 27001 requires regular awareness training, evaluation of its effectiveness and retained records; the organization sets the hours.