近年來，網路攻擊頻繁發生，資訊安全問題備受關注。為加強資安防護， 政府頒布一系列法規和標準，對組織的資安管理提出更高要求。在此背景下， 如何確保資訊系統安全，成為政府機關與資服業者共同面臨的重大課題。 本研究以資服業者承接的政府專案為例，採用個案研究來探討中小型資服 業者在滿足客戶需求和遵循資安標準中的挑戰。聚焦分析資訊系統在符合「資 通系統防護基準」的程度或差異，並提出改善對策。 研究使用文件分析、深度訪談、屬性抽樣等質性方法，以資通安全管理法 及子法、ISO/IEC 27001、CBE、SBOM 等為依據，從專案管理、開發測試、供 應鏈管理、稽核實施等角度，梳理專案的資安管理情況，找尋問題與不足。 研究發現，中小型資服業者受限於資源、客戶需求多變、人員能力參差等 因素，在落實資安控制時面臨諸多困境。專案暴露需求不明確、安全控制不完 善、供應鏈管理鬆散等問題，難以全面符合「資通系統防護基準」要求。 據此，研究提出強化變更管理、引入威脅建模、落實安全編碼規範、完善 元件管理、細化稽核日誌、加強安全意識培訓等建議，以幫助中小型資服業者 提升專案的安全品質，強化整體資安防護，平衡合規要求和成本效率。 本研究深化了對資安標準落實的微觀理解，揭示了合規驅動資安治理的侷 限性，對主管機關和產業界推動完善資訊系統的安全有啟示的意義。;In recent years, frequent cyber attacks have heightened concerns over information security. To strengthen data protection, the government has implemented various regulations and standards, increasing demands on organizational security management. This study focuses on a government project undertaken by an IT service provider, using case studies to explore the challenges small and medium-sized IT firms face in meeting client needs while adhering to security standards. The research employs qualitative methods such as document analysis and in-depth interviews to evaluate the project′s adherence to "Information System Protection Standards" and identifies areas for improvement. Findings reveal that these firms struggle with resource limitations, fluctuating client demands, and varying staff capabilities, leading to unclear requirements, inadequate security controls, and loose supply chain management. Consequently, the study suggests enhancing change management, threat modeling, security coding practices, component management, audit logs, and security awareness training to improve project security quality and strengthen overall data protection, balancing compliance requirements with cost-efficiency. This research deepens the understanding of security standard implementation and highlights the limitations of compliance-driven security governance, providing insights for regulatory bodies and the industry to improve information system security.
