Information Security
Information and Communication Technology (ICT) Security Governance
I. ICT Security Risk Management Framework
To strengthen ICT security management, on March 18, 2024, the Board of Directors appointed the Vice President of the Finance and Administration Division as the designated officer responsible for ICT Security and Personal Data Protection. The Business Technology Department serves as the dedicated ICT security unit, while the heads of each first-level department serve as Personal Data Protection representatives. Together, they are responsible for the cross-functional governance, planning, supervision, and implementation of ICT security and personal data protection across the Company, its subsidiaries, and sub-subsidiaries.
The Internal Audit Office serves as the supervisory unit for ICT security governance and has dedicated internal audit personnel responsible for supervising the implementation of ICT security and personal data protection measures. If deficiencies are identified during audits, the audited units are immediately required to propose improvement plans and specific corrective actions. The effectiveness of such improvements is also regularly followed up to reduce internal ICT security risks.
The dedicated ICT Security and Personal Data Protection unit shall comply with applicable government laws, regulations, and policy requirements to ensure the continued and effective implementation of the ICT security and personal data protection inspection system. The unit reports the Company's ICT security and personal data protection governance and implementation results to the Board of Directors on an annual basis.
II. ICT Security Policy
The Company complies with applicable laws and regulations in establishing relevant management policies and procedures for ICT security and personal data protection. Appropriate protection measures are implemented for the Company's information assets and personal data to ensure their confidentiality, integrity, availability, and legal compliance.
The Company ensures the confidentiality, integrity, and availability of information assets under its custody, thereby safeguarding the security of data and files associated with the Company's operations.
The Company regularly assesses the potential impact of various human-induced and natural disasters on ICT security and personal data protection. Disaster prevention measures and disaster recovery plans are established for critical information assets and key business operations to ensure business continuity.
III. ICT Security Protection and Control Measures
The Company has implemented the following ICT security protection and control measures:
Anti-virus software.
Network firewalls.
Where mail servers are in use, email filtering mechanisms are implemented.
Intrusion detection and prevention mechanisms.
Where core ICT systems provide external-facing services, application firewalls are implemented.
Employee onboarding, employment, and offboarding management procedures are conducted in accordance with the Company's personnel regulations. All employees are required to sign confidentiality agreements.
Privileged administrator accounts, user accounts, and access permissions are reviewed regularly.
The Company monitors security vulnerability advisories and promptly patches high-risk vulnerabilities. Security vulnerabilities in hardware devices, system components, database systems, and software are regularly assessed and remediated.
When ICT equipment is physically decommissioned following disposal approval, it shall be destroyed using appropriate destructive methods, and the Company shall ensure that all confidential data has been deleted.
The Company has established regulations governing the use of computer equipment. Employees are prohibited from installing unauthorized software. Corporate email accounts shall only be used for sending and receiving business-related correspondence. The use of personal mobile devices and portable media devices should be avoided where appropriate.
ICT security responsibilities and confidentiality requirements for outsourced service providers are specified in procurement documents or contracts, including service-level agreements, ICT security requirements, and the Company's right to conduct ICT security audits of outsourced service providers.
Contracts shall specify that, upon termination or expiration of an outsourcing relationship, the service provider shall return, transfer, delete, or destroy all data held in connection with the performance of the contract.
IV. Specific Management Measures
Management Area | Implementation Status |
|---|---|
Computer System and Network Security Management | The Company has established firewalls and an appropriate network security infrastructure to provide necessary monitoring and filtering of all traffic, including outbound traffic, application-layer traffic, online transactions, communications and connectivity such as IPSec or SSL VPN, and dynamic workflows, thereby providing effective protection against network attacks. Anti-virus software is installed on every computer and virus definitions are updated regularly. |
Personnel Management and Security Awareness Training | The ICT security unit conducts ICT security awareness programs on a quarterly basis to enhance employees' awareness of cybersecurity risks. In 2024, four awareness sessions were conducted; in 2025, three awareness sessions were conducted. The Company also provides an Information Security Awareness and Education Training course as part of the pre-employment training for new employees. The ICT security unit establishes individual user accounts, passwords, and access privileges for new employees and manages their access to internal corporate databases. New employees are required to sign confidentiality agreements to reduce the risk of personal data leakage. |
Information Asset Security Management | The ICT security unit conducts a company-wide software inventory and maintains relevant records every six months. The inventory was conducted in August 2024 and in June and December 2025. The Internal Audit Office also regularly audits personal data protection practices and c |
| Business Continuity | The Company conducts a disaster recovery and business restoration drill once a year to maintain system availability and emergency response capabilities. Drills were conducted on July 31, 2024 and November 30, 2025. |
| Supervision and Review | The ICT security unit reported the Company's ICT security status to the Board of Directors on November 10, 2025. The ICT security unit reports on ICT security and personal data protection management at weekly department meetings held every Wednesday and at monthly division-level project meetings. As of the reporting date, no personal data breaches have occurred (0 incidents). |
V. ICT Security Management Process Flowchart
