The 22 essential requirements 22 項必要要求

(1) Products with digital elements shall be designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity based on the risks.

(1) 具數位元素產品之設計、開發與生產，應依風險確保適當之網路安全水準。

2(a) Made available on the market without known exploitable vulnerabilities.

2(a) 投放市場時不含已知可利用之弱點。

2(b) Made available with a secure by default configuration, including the possibility to reset the product to its original state.

2(b) 以安全預設組態投放市場，包含可將產品重設為原始狀態之功能。

2(c) Ensure that vulnerabilities can be addressed through security updates, including, where applicable, through automatic security updates installed within an appropriate timeframe enabled as a default setting.

2(c) 確保可透過安全更新處理弱點；於適用時，包含預設啟用之自動安全更新於適當時程內完成。

2(d) Ensure protection from unauthorised access by appropriate control mechanisms, including but not limited to authentication, identity or access management systems, and report on possible unauthorised access.

2(d) 透過適當控制機制（含但不限於認證、身分或存取管理系統）確保免於未經授權之存取，並回報可能之未經授權存取。

2(e) Protect the confidentiality of stored, transmitted or otherwise processed data, personal or other, such as by encrypting relevant data at rest or in transit by state of the art mechanisms.

2(e) 保護儲存、傳輸或以其他方式處理之資料（個人資料或其他）之機密性，例如以先進機制對靜態或傳輸中之相關資料加密。

2(f) Protect the integrity of stored, transmitted or otherwise processed data, personal or other, commands, programs and configuration against any manipulation or modification not authorised by the user, and report on corruptions.

2(f) 保護儲存、傳輸或以其他方式處理之資料（個人資料或其他）、命令、程式、組態之完整性，使免於未經使用者授權之操作或修改；並回報遭破壞之情形。

2(g) Process only data, personal or other, that are adequate, relevant and limited to what is necessary in relation to the intended purpose of the product with digital elements (data minimisation).

2(g) 僅處理與產品預期用途相當、相關、且限於必要之資料（個人資料或其他），資料最小化。

2(h) Protect the availability of essential and basic functions, also after an incident, including through resilience and mitigation measures against denial-of-service attacks.

2(h) 保護產品基本與核心功能之可用性，含事件發生後；包括對阻斷服務攻擊之韌性與緩解措施。

2(i) Minimise the negative impact by the products themselves or connected devices on the availability of services provided by other devices or networks.

2(i) 最小化產品本身或連接裝置對其他裝置或網路所提供服務之可用性之負面影響。

2(j) Be designed, developed and produced to limit attack surfaces, including external interfaces.

2(j) 設計、開發、生產應限制攻擊面，含外部介面。

2(k) Be designed, developed and produced to reduce the impact of an incident using appropriate exploitation mitigation mechanisms and techniques.

2(k) 設計、開發、生產應透過適當之利用緩解機制與技術，降低事件之影響。

2(l) Provide security related information by recording and monitoring relevant internal activity, including the access to or modification of data, services or functions, with an opt-out mechanism for the user.

2(l) 透過記錄及監控相關內部活動（含資料、服務或功能之存取或修改）提供安全相關資訊，並提供使用者退出機制。

2(m) Provide the possibility for users to securely and easily remove on a permanent basis all data and settings and, where such data can be transferred to other products or systems, ensure that this is done in a secure manner.

2(m) 提供使用者安全且簡便地永久刪除所有資料與設定之可能；於該資料可轉移至其他產品或系統時，確保以安全方式為之。

(1) Identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products.

(1) 辨識並記載具數位元素產品中包含之弱點與元件，包括以常用且機器可讀之格式，產製至少涵蓋產品頂層相依關係之軟體物料清單（SBOM）。

(2) In relation to the risks posed to products with digital elements, address and remediate vulnerabilities without delay, including by providing security updates; where technically feasible, new security updates shall be provided separately from functionality updates.

(2) 依產品所面對之風險，及時處理並修正弱點，含提供安全更新；於技術可行時，新安全更新應與功能更新分開提供。

(3) Apply effective and regular tests and reviews of the security of the product with digital elements.

(3) 對具數位元素產品之安全進行有效且定期之測試與審查。

(4) Once a security update has been made available, share and publicly disclose information about fixed vulnerabilities, including a description of the vulnerabilities, information allowing users to identify the product with digital elements affected, the impacts, their severity and clear and accessible information helping users to remediate the vulnerabilities.

(4) 安全更新提供後，分享並公開披露已修復弱點之資訊，包括弱點描述、使用者識別受影響產品之資訊、影響及嚴重性、以及協助使用者修補之明確易讀資訊。

(5) Put in place and enforce a policy on coordinated vulnerability disclosure.

(5) 建立並執行協調揭露政策（CVD policy）。

(6) Take measures to facilitate the sharing of information about potential vulnerabilities in their product with digital elements as well as in third-party components contained in that product, including by providing a contact address for the reporting of the vulnerabilities discovered in the product with digital elements.

(6) 採取措施以促進就產品及其第三方元件之潛在弱點資訊分享，含提供弱點通報之聯絡地址。

(7) Provide for mechanisms to securely distribute updates for products with digital elements to ensure that vulnerabilities are fixed or mitigated in a timely manner and, where applicable for security updates, in an automatic manner.

(7) 提供安全派送產品更新之機制，以確保弱點及時修復或緩解；於適用時（安全更新），以自動方式為之。

(8) Ensure that, where security updates are available to address identified security issues, they are disseminated without delay and, unless otherwise agreed between a manufacturer and a business user in relation to a tailor-made product with digital elements, free of charge, accompanied by advisory messages providing users with the relevant information, including on potential action to be taken.

(8) 確保於安全更新可供處理已辨識安全問題時，無遲延派送，且除製造商與商業使用者就客製化產品另有約定外，免費提供，並伴隨相關建議訊息，含使用者可能需採取之行動資訊。