在當前地緣政治和國際緊張局勢日益加劇的背景下，全球資訊安全風險逐步上升，對資訊安全的需求愈加迫切。在此情況下，美國於2019年發布了網絡安全成熟度模型認證（CMMC），旨在強化國防供應鏈的網路安全，並將此標準納入供應商評估過程中。該政策不僅影響美國企業，也對赴美設廠的全球企業產生深遠影響。面對日益緊張的國際形勢，台灣政府計畫引進CMMC認證，以加強國防供應鏈的資訊安全。當前，ISO 27001作為台灣廣泛採用的資訊安全管理主要標準，為許多企業提供了一套完整的資訊安全框架。因此，如何在ISO 27001標準架構下提前準備導入CMMC，已成為台灣企業需要重視的問題。
本研究透過文獻整理，匹配CMMC與ISO 27001相關的控制措施及CMMC官方文件建議的檢查項目，並輔以專家訪談蒐集專家對此匹配結果的意見，以了解目前台灣業界對於CMMC標準導入的看法。根據訪談結果與相關文獻統整後，研擬一份自評表。初步研擬自評表後，進行第二次專家訪談，驗證自評表是否能夠作為提高台灣企業合規CMMC認證準備度的工具，並收集專家對自評表後續修正的建議，作為未來CMMC自評表建構的參考依據。研究結果提供了實務評估中兩項標準之對應參照及重點檢查項目評估的自評表，並為後續研究CMMC自評表的製作及CMMC評估流程的步驟提供建議。

In the context of heightened geopolitical and international tensions, global information security risks are increasing, necessitating urgent enhancements in security measures. In 2019, the United States introduced the Cybersecurity Maturity Model Certification (CMMC) to bolster network security within the defense supply chain and integrated this standard into the supplier evaluation process, significantly impacting both American and global businesses operating in the U.S. As international tensions continue to escalate, the Taiwanese government plans to adopt the CMMC certification to strengthen its defense supply chain's information security. Currently, ISO 27001 serves as the primary standard for information security management in Taiwan, providing a comprehensive security framework for numerous businesses. Thus, effectively integrating CMMC within the ISO 27001 framework is a crucial issue for Taiwanese enterprises.
This study aims to align CMMC with ISO 27001 by reviewing literature on related control measures and selecting check items recommended in official CMMC documentation, complemented by expert interviews to validate and suggest improvements for this alignment. The interviews and literature review help understand the Taiwanese industry's perspective on adopting the CMMC standard. A self-assessment checklist is drafted based on the interview outcomes and literature synthesis to ensure closer alignment with CMMC standards. A second round of expert interviews will assess whether this checklist can serve as a tool to enhance Taiwanese enterprises' readiness for CMMC certification and propose necessary modifications. The results offer a practical assessment tool comparing both standards and provide a self-assessment checklist for evaluating key check items, aiding in the development and implementation of future CMMC self-assessments.

				主目錄
表目錄	viii
圖目錄	xi
第一章 緒論	1
第一節 研究背景、動機與目的	1
第二章 文獻探討	4
第一節 資訊安全定義與評估方式	4
第二節 受控非機密資訊的重要性	6
第三節 CMMC 2.0架構評估內容	7
第四節 ISO 27001標準規範	10
第五節 ISO與CMMC比較研究	11
第三章 研究方法	13
第一節 研究流程	13
第二節 研究設計	14
第四章 研究設計與分析	20
第一節 訪談問卷以及問項設計	20
第二節 第一階段專家深度訪談結果	23
第三節 企業自評表設計結果	63
第四節 第二階段專家訪談結果	69
第五章 研究討論	74
第一節 CMMC對應ISO 27001結果	74
第二節 資訊安全重要項目文件	78
第三節 自評表設計	80
第四節 ISO 27001與CMMC標準評估差異	81
第六章 研究結論	83
第一節 研究結論	83
第二節 管理意涵	85
第三節 研究限制與未來研究建議	86
參考資料	88
附錄A ：第一階段訪談大綱	93
附錄B ：第一階段訪談問卷	95
附錄C ：第二階段訪談大綱	108
附錄D ：第一階段訪談檢查項目統計表	111

表目錄
表 2.1相關文獻整理	12
表 4.1 ISO 27001:2013、ISO 27001:2022與CMMC 2.0對照結果	21
表 4.2第一階段訪談問項	23
表 4.3 AC.L1-3.1.1對應ISO 27001統計與意見彙整表	24
表 4.4 AC.L1-3.1.1授權訪問控對應ISO 27001控制措施	26
表 4.5 AC.L1-3.1.2對應ISO 27001統計與意見彙整表	27
表 4.6 AC.L1-3.1.2操作與功能對應ISO 27001控制措施	28
表 4.7 AC.L1-3.1.20對應ISO 27001統計與意見彙整表	29
表 4.8 AC.L1-3.1.20控制外部連接對應ISO 27001控制措施	30
表 4.9 AC.L1-3.1.22對應ISO 27001統計與意見彙整表	31
表 4.10 AC.L1-3.1.22控制公共資訊對應ISO 27001控制措施	32
表 4.11 IA.L1-3.5.1對應ISO 27001統計與意見彙整表	33
表 4.12 IA.L1-3.5.1識別對應ISO 27001控制措施	34
表 4.13 IA.L1-3.5.2對應ISO 27001統計與意見彙整表	35
表 4.14 IA.L1-3.5.2身分驗證對應ISO 27001控制措施	36
表 4.15 MP.L1-3.8.3對應ISO 27001統計與意見彙整表	37
表 4.16 MP.L1-3.8.3媒體處置對應ISO 27001控制措施	38
表 4.17 PE.L1-3.10.1對應ISO 27001統計與意見彙整表	39
表 4.18 PE.L1-3.10.1限制實體訪問對應ISO 27001控制措施	40
表 4.19 PE.L1-3.10.3對應ISO 27001統計與意見彙整表	41
表 4.20 PE.L1-3.10.3護送訪客對應ISO 27001控制措施	41
表 4.21 PE.L1-3.10.4對應ISO 27001統計與意見彙整表	42
表 4.22 PE.L1-3.10.4實體訪問紀錄對應ISO 27001控制措施	43
表 4.23 PE.L1-3.10.5對應ISO 27001統計與意見彙整表	45
表 4.24 PE.L1-3.10.5管理實體訪問對應ISO 27001控制措施	46
表 4.25 SC.L1-3.13.1對應ISO 27001統計與意見彙整表	47
表 4.26 SC.L1-3.13.1邊界保護對應ISO 27001控制措施	48
表 4.27 SC.L1-3.13.5對應ISO 27001統計與意見彙整表	49
表 4.28 SC.L1-3.13.5公共訪問系統分離對應ISO 27001控制措施	50
表 4.29 SI.L1-3.14.1對應ISO 27001統計與意見彙整表	51
表 4.30 SI.L1-3.14.1缺陷修復對應ISO 27001控制措施	53
表 4.31 SI.L1-3.14.2對應ISO 27001統計與意見彙整表	54
表 4.32 SI.L1-3.14.2惡意程式防護對應ISO 27001控制措施	55
表 4.33 SI.L1-3.14.4對應ISO 27001統計與意見彙整表	57
表 4.34 SI.L1-3.14.4更新惡意程式碼防護對應ISO 27001控制措施	58
表 4.35 SI.L1-3.14.5對應ISO 27001統計與意見彙整表	59
表 4.36 SI.L1-3.14.5系統和文件掃描對應ISO 27001控制措施	59
表 4.37自評表檢查項目	67
表 5.1 CMMC與ISO 27001:2022對應表	74
圖目錄
圖 2.1資訊安全架構	6
圖 2.2 CMMC分層式架構	10
圖 3.1研究架流程	14
圖 4.1資通安全實地稽核項目檢核表	65
圖 4.2 113年資通安全稽核實地稽核表適用特定非公務機關	65
圖 4.3自評表	66
圖 4.4自評表說明	68

教育部(2022)。教育部111至112年度對所屬公務機關及所管特定非公務機關資通安全稽核計畫公布新版檢核表。ISCB POSTED DATE。https://iscb.nchu.edu.tw/2022/04/111112.html
數位發展部(2023年4月20日)。唐鳳部長與美國在台協會主席羅森柏格女士會面 期許互助深化民主。數位發展部。https://moda.gov.tw/press/press-releases/4477
數位發展部(2022年8月27日)。資安演練與稽核。資通安全署。https://moda.gov.tw/ACS/operations/drill-and-audit/652
謝宜庭(2022)。由ISO 27001與CMMC的差異分析來看符合ISO 27001的企業該如何導入CMMC之方法〔未出版之碩士論文〕。國立台灣科技大學資訊管理學系碩士論文。
LRQA(2022)。控制措施對照指南-ISO 27001:2013和ISO :27001:2022。LRQA。https://www.lrqa.com/zh-tw/resources/iso27001-2022-comparison-guide/
Akçoraoğlu, A. (2019). ‘Yeni Kapitalizm’Teorileri, Dijital Devrim ve Türkiye Kapitalizmi. Mülkiye Dergisi, 43(3), 525-575.
Alshar’e, M. (2023). CYBER SECURITY FRAMEWORK SELECTION: COMPARISION OF NIST AND ISO27001. Applied Computing Journal, 3(1), 245-255. https://doi.org/10.52098/acj.202364
Canbek, G., & Sağıroğlu, Ş. (2006). Bilgi ve bilgisayar güvenliği: casus yazılımlar ve korunma yöntemleri. Grafiker Limited Şti.
Cannoy, S., Palvia, P. C., & Schilhavy, R. (2006). A Research Framework for Information Systems Security. Journal of Information Privacy and Security, 2(2), 3–24. https://doi.org/10.1080/15536548.2006.10855789
Chapman, D. B., & Zwicky, E. D. (1995). Building internet firewalls. O'Reilly & Associates, Inc..
Del Vecchio, J., Levy, Y., Wang, L., & Kumar, A. (2024). Towards Assessing Cybersecurity Posture of Manufacturing Companies：Review and Recommendations. 2023 KSU Conference on Cybersecurity Education, Research and Practice. 5. https://core.ac.uk/download/596819459.pdf
Dhillon, G., & Backhouse, J. (2000). Technical opinion: Information system security management in the new millennium. Communications of the ACM, 43(7), 125-128.
DoD, U. (2021 March 26). Cybersecurity maturity model certification (cmmc). Cobalt, https://cobalt. io/blog/what-is-cybersecurity-maturity-model-certificationcmmc
DoD, U. (2022a). CYBERSECURITY MATURITY MODEL CERTIFICATION. DoD, U. https://dodcio.defense.gov/CMMC/, Retrieved 2024/2/22.
DoD, U. (2022b). CMMC MODEL. DoD, U. https://dodcio.defense.gov/CMMC/Model/, Retrieved 2024/2/22.
Feigenbaum, J. (2022). Protecting Controlled Unclassified Information from Supply Chain Attacks in Department of Defense Contracts [Unpublished master’s thesis]. Utica University.
Futures, I. (2021 December). CMMC Self-Assessment Guide - Level 1. DoD, U. https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level1_V2.0_FinalDraft_20211210_508.pdf
Gollmann, D. (2011). Computer security. Wiley. 
Hassinen, T. (2017). Enhancing Cyber Security for SME organizations through self-assessments: How self-assessment raises awareness [Unpublished master’s thesis]. Jyväskylän ammattikorkeakoulu. https://www.theseus.fi/bitstream/handle/10024/125437/Hassinen_Tarmo.pdf?sequence=1
Humphreys, E. (2011). Information security management system standards. Datenschutz und Datensicherheit-DuD, 35, 7-11. https://doi.org/10.1007/s11623-011-0004-3
ISO, I. S. O. (2000). 17799：Information technology-code of practice for information security management. Technical report, ISO.
Koza, E. (2022). Semantic analysis of ISO/IEC 27000 standard series and NIST cybersecurity framework to outline differences and consistencies in the context of operational and strategic information security. Med. Eng. Themes, 2, 26-39. https://themedicon.com/pdf/engineeringthemes/MCET-02-021.pdf
Levy, Y., & Gafni, R. (2022). Towards the quantification of cybersecurity footprint for SMBs using the CMMC 2.0. Online Journal of Applied Knowledge Management (OJAKM), 10(1), 43-61. https://doi.org/10.36965/OJAKM.2022.10(1)43-61
Malatji, M. (2023). Management of enterprise cyber security: A review of ISO/IEC 27001:2022. 2023 International Conference On Cyber Management And Engineering (CyMaEn), 117–122. https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=10051114
McAfee. (2018 February). Economic Impact of Cybercrime—No Slowing Down Executive Summary. McAfee. https://csis-website-prod.s3.amazonaws.com/s3fs-public/publication/economic-impact-cybercrime.pdf
OUSD, A. S. (2022). CMMC Documents [Grant]. OUSD, A. S. https://www.acq.osd. mil/cmmc/documentation.html, 
Ramadhan, R. A., Rachmat Setiawan, P. ., & Hariyadi, D. . (2022). Digital Forensic Investigation for Non-Volatile Memory Architecture by Hybrid Evaluation Based on ISO/IEC 27037:2012 and NIST SP800-86 Framework. IT Journal Research and Development, 6(2), 162–168. https://doi.org/10.25299/itjrd.2022.8968
Ross, R., Pillitteri, Dempsey, Riddle, Mark , Guissanie, Gary. (2020 February). Protecting controlled unclassified information in nonfederal systems and organizations. Information Technology Laboratory COMPUTER SECURITY RESOURCE CENTER. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r2.pdf, Retrieved 2024/1/12.
Ross, R., Viscuso, P., Guissanie, G., Dempsey, K., & Riddle, M. (2015). Protecting controlled unclassified information in nonfederal information systems and organizations. US Department of Commerce, National Institute of Standards and Technology.
Roy, P. P. (2020). A High-Level Comparison between the NIST Cyber Security Framework and the ISO 27001 Information Security Standard. 2020 National Conference on Emerging Trends on Sustainable Technology and Engineering Applications (NCETSTEA), 1–3. https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=9119914
Russell, D., & Gangemi, G. T. (1991). Computer security basics. O'Reilly Media, Inc.
Scarfone, K., Souppaya, M., Cody, A., & Orebaugh, A. (2008). Technical guide to information security testing and assessment. NIST Special Publication, 800(115), 2-25. https://git.hsbp.org/six/PTD/raw/commit/9e642f4aa921f2bc83b012326ce0ed23c0af4e53/methodology_documents/NIST_SP800-115.pdf
Schultz, E. E., Proctor, R. W., Lien, M.-C., & Salvendy, G. (2001). Usability and Security An Appraisal of Usability Issues in Information Security Methods. Computers & Security, 20(7), 620–634. https://www.sciencedirect.com/science/article/pii/S016740480100712X
Smith, M. (1989). Computer security-threats, vulnerabilities and countermeasures. Inf. Age, 11(4), 205–210. https://dl.acm.org/doi/abs/10.5555/69134.69137
Tudor J. K. (2001). Information Security Architecture：An Integrated Approach to Security in the Organization. CRC Press, Boca Raton.