INFORMATION AND COMMUNICATION SECURITY POLICY
“Implement Information Security Protection and Ensure Operational Security”Information and Communication Security Policy
To ensure the smooth operation of information and communication systems, services, and networks; mitigate risks arising from human error, intentional acts, or natural disasters; prevent unauthorized access, use, control, disclosure, destruction, alteration, deletion, or other infringement; and safeguard the confidentiality, integrity, and availability of information assets, this Information and Communication Security Policy is hereby established.1. Formulate information and communication security management regulations in accordance with applicable laws and regulations, with reference to requirements such as the Information and Communication Security Control Guidelines for TWSE- and TPEx-Listed Companies.
2. Monitor developments in information and communication security; identify changes in internal and external issues and their interactions with stakeholders’ needs and expectations; analyze risks, develop response strategies, and implement measures to minimize impacts on operations.
3. Establish an information and communication security organizational structure with clearly defined roles, responsibilities, and authorities; implement protective measures and fulfill management responsibilities.
4. Implement information and communication security education and training to ensure employees understand their security responsibilities and enhance security awareness.
5. Regularly inventory information assets and apply risk assessment mechanisms to effectively manage items that may have an impact.
6. Strengthen physical, environmental, and equipment protection, and perform regular servicing and maintenance to maintain normal operations.
7. Establish network transmission rules to protect sensitive documented information and prevent unauthorized access and alteration.
8. Conduct information and communication security audits to review and identify issues, develop countermeasures, and implement corrective actions.
9. Develop emergency response plans and conduct regular drills to prepare for unexpected incidents and rapidly restore operations.
10. Establish information and communication security responsibilities and confidentiality requirements, and require the signing of confidentiality undertakings to protect privacy and sensitive information.
11. Obtain intelligence on information security threats, establish monitoring activities, and prepare preventive countermeasures in advance.
12. Periodically review the information and communication security policy to reflect the latest developments in security management, laws and regulations, technology, and operations, and to ensure the feasibility and effectiveness of security practices.