Background

Outdoor activities at the National Nature Park, Taichung Metropolitan Park and Kaohsiung Metropolitan Park are booked through an online application system. After reassessing confidentiality, integrity and availability, the system's protection level was raised from basic to medium, which under Taiwan's cybersecurity responsibility regulations requires medium-level control measures. No-show applicants also needed to be managed.

Problems to solve

  • Meet the medium-level baseline with evidence for every item on the control checklist.
  • No reminder or restriction for no-shows, so activity places were wasted.
  • Applicants could not look up or cancel their own bookings.
  • Managing lists and moving people to the blocklist was manual.

What JIE HENG did

Security upgrade. Checked each medium-level item of the government cybersecurity baseline, covering access control, audit and accountability, system and communications protection, and system and information integrity; completed the measures and delivered the checklist, evidence and risk analysis report. Vulnerability scanning and remediation were done before launch.

Member blocklist. A prompt at application explains the no-show count and the resulting restriction; administrators set the threshold and the restriction period (three months, six months), lifted automatically on expiry; the check-in list shows no-show counts and moves people to the blocklist in one click.

Self-service. Members can view and cancel their bookings; confirmation emails automatically include activity details, which administrators can toggle.

Administration. Name and account search on member and blocklist pages.

Outcome

  • The system passed the medium-level baseline review with checklist, evidence and risk analysis delivered.
  • No-show handling moved from manual work to automatic prompts, restriction and release.
  • Applicants self-serve lookups and cancellations, reducing calls and emails to staff.
  • After acceptance the system entered warranty, and JIE HENG continues annual maintenance and feature enhancements of the outdoor activity management system.

Maintenance

Annual maintenance covers issue handling, vulnerability fixes and feature enhancements; changes follow the agency's ISMS change request process.

What this means for enterprises

For a company, this is the case of a public-facing system passing a security audit by completing the control measures rather than only adding a firewall.

Cập nhật: 2026-11-02