1. In order to enhance the information device management of the Ministry of Finance (MOF) and its subordinate agencies and local tax collection agencies (hereinafter referred to as the agencies), the MOF’s Fiscal Information Agency has developed a device management system (hereinafter referred to as the SDM system) for the agencies to register device information for effective management of information device, as well as for device configuration, information security assessment, and information budget acquisition and allocation.

2. The information device referred to in these Operating Regulations includes personal computers (including notebooks), servers, printers, and other information devices.

3. The information devices to be registered includes information devices subsidized or allocated by the Fiscal Information Agency, purchased by the agencies, and donated or transferred by other institutions (organizations).

4. All agencies should register in the SDM system immediately when the device is allotted, retired, or scrapped; if the registration is not confirmed, the annual allotment of devices or budget will be reduced or stopped depending on the severity of the situation. In order to understand the registration status of each agency, this operation will be included in the key points of information business assessment and information security audit, and will be used as an important reference for subsidizing or approving information devices and auditing the amount of maintenance expenses.

5. In order to understand the allocation ratio of information devices of each agency, each agency should cooperate in the registration of the budget and actual quota of staff.

6. The procurement of information devices within each agency that is not conducted by the main (concurrent) information business unit should be signed to the main (concurrent) information unit to facilitate the control of devices.

7. Before the 5th of each month, each agency should print out the type, name, and quantity of the information device changed in the previous month on the SDM system, assign a person to check whether the device changed in that month has been registered in the system, and present it to the section supervisor. After review, the list of changes will be scanned into a PDF file and sent back to the system administrator for review and reference. The list of device changes should be kept for at least three years for reference.

8. When conducting internal audits of information security or annual property inventory operations, each agency shall conduct at least one SDM system data audit per year as follows:
(A) Internal audit, a sample of at least 10% of all devices, to compare the SDM system registration content with the actual status. The internal audit records shall be kept for at least three years for reference.
(B) Comprehensive inventory: Conduct a comprehensive inventory of devices.

9. The Fiscal Information Agency of the MOF may conduct auditing operations or merge with the annual external auditing process for each agency as needed. Each agency should cooperate and provide relevant information such as device inventory, list of changes, and internal audit.