Investor Area

 

Information Security Policy

1.資通安全風險管理架構

　(1) The company has established a Group Information Department dedicated to information and communication security. This department consists of an Information Supervisor and specialized information professionals responsible for formulating group information and communication security policies, planning and implementing information and communication security operations, and promoting and enforcing information and communication security policies.
　(2)The company's Group Audit Office serves as the supervisory unit for information and communication security. This office includes one Audit Supervisor who is responsible for overseeing the internal implementation status of information and communication security. In the event of identified deficiencies during audits, the Audit Supervisor may request the audited units to submit relevant improvement plans. Additionally, regular monitoring of the effectiveness of improvements is conducted to mitigate internal information and communication security risks.
   (3)An annual report on the operational status is presented to the Board of Directors. The report for the year ending December 13, 2023, has already been submitted to the Board of Directors.

 

2.資通安全政策

Item	Content
1(Purpose)	(1)To ensure the security of the company's servers (including cloud servers), data storage, network communications, and all operational technology (OT) devices, and to prevent unauthorized access, use, data breaches, tampering, disruption, or any other infringements on information and communication, the following measures and practices will be implemented to maintain the confidentiality, integrity, and availability of the company's digital information.
2(Scope)	(1)The scope of this policy applies to the company, its subsidiaries, all employees, as well as businesses, vendors, visitors, and other entities with whom the company conducts business.
3(Target)	(1)Ensure the continuous operation of information processes within the company, with accuracy, completeness, and availability. (2)Safeguard the confidentiality of critical information within the company by implementing data access controls, ensuring that information is accessed only by authorized personnel, and preventing unauthorized access.。
4(Information Security Control Measures)	(1) All information policies of the company must comply with local government regulations. (2) Establish a dedicated information security officer to establish and promote relevant information security systems. (3) Effectively manage information assets and continuously assess corresponding risks. (4) Establish an independent information system room and environmental safety protection measures, and make regular maintenance and maintenance plans. (5) Assess various natural and man-made disaster risks, and formulate a core information system restoration and exercise plan to ensure that the core information system can be restored and operate normally when it is damaged due to various conditions. (6) Regularly implement information security publicity, education and training and related implementation regulations. (7) Clearly regulate the use authority of the information system to ensure that only authorized users can access the information system. (8) Implement the management of outsourced manufacturers to ensure the safety of information services. (9) Formulate an internal audit plan for the information security management system, regularly review the use of all personnel and equipment within the scope of the information security management system, and formulate and implement corrective and preventive measures according to the audit report.
5	(1)This policy was implemented following approval by the Board of Directors, and any amendments will follow the same procedure. (2)The policy was established on December 23, 2021.

 

 

3.The specific management plan and the resources invested in the security management of information communication

　(1) All information policies of the company must comply with local government regulations.
　(2) Establish a dedicated information security officer to establish and promote relevant information security systems.
   (3) Effectively manage information assets and continuously assess corresponding risks.
   (4) Establish an independent information system room and environmental safety protection measures, and make regular maintenance and maintenance plans.
   (5) Assess various natural and man-made disaster risks, and formulate a core information system restoration and exercise plan to ensure that the core information system can be restored and operate normally when it is damaged due to various conditions.
   (6) Regularly implement information security publicity, education and training and related implementation regulations.
   (7) Clearly regulate the use authority of the information system to ensure that only authorized users can access the information system.
   (8) Implement the management of outsourced manufacturers to ensure the safety of information services.
   (9) Formulate an internal audit plan for the information security management system, regularly review the use of all personnel and equipment within the scope of the information security management system, and formulate and implement corrective and preventive measures according to the audit report.

 

4.Invest resources in the information security management

　⚫ To ensure the effective operation of the Information Security Management System, one Information Security Officer and one Information Security Personnel are appointed. They are responsible for promoting and maintaining various aspects of information and communication security management, as well as executing and auditing related tasks. When necessary, they may convene meetings and invite relevant personnel to participate.

　⚫ The company conducts annual discussions to review and improve various aspects of the information security framework, including information security policies and procedures, cybersecurity education and training, data center management practices, continuous operational exercise implementation plans, and external audit management procedures. These discussions aim to enhance and refine the information security management mechanisms for better effectiveness.

　⚫ Execution Status in the Year 2023:

Item	Date	Content
Information Security Education and Promotion.	112/4/12 112/10/18	Twice
Technical Tools	112/2/4	UTM NU-8700C
	112/3/10	Mail server MS 6430X
Rationality and Audit	112/8/8	Host Vulnerability Scanning
	112/7/14	Enterprise Cybersecurity Rating Assessment
	112/11/6	KPMGExternal Information Security Audit
Emergency Response Plan	112/10/7	Continuity of Operations Exercise Implementation Plan
Disaster Drill	112/11/1	Continuity of Operations Exercise Implementation
Security Conference	112/11/27	1.Sharing the latest information security-related knowledge, including recent threats, vulnerabilities, and security measures. 2.Discussing the ever-evolving information security requirements, including new technologies and regulatory changes.

 

 

Risk Management Policy and Procedures and Operation Status

　In 2022, the Company established the "Risk Management Policy and Procedures," which was approved by the Board of Directors, serving as the Company's highest guiding principle for risk management. The Company conducts regular annual assessments of operational risks and formulates response strategies for various risks. These strategies encompass management objectives, organizational structure, roles and responsibilities, and risk management procedures. They are implemented to effectively identify, measure, and control the company's various risks, keeping risks within acceptable limits.

 

Scope of Risk Management

　The Company actively oversees the assessment and management of significant risks in various aspects of its operations, including economic, environmental, and social aspects. In addition to existing regulatory frameworks and procedures, the company conducts proactive monitoring and evaluation of important risks. The company's management assesses risks and formulates mitigation measures based on the nature of their responsibilities. The areas covered by risk management include "Market Risk," "Operational Risk," "Investment Risk," "Compliance Risk," and "Climate Change Risk," among others. The "Risk Management Policy and Procedures" of the company were implemented after approval by the Board of Directors on November 9, 2022, as outlined in the "Company's Important Regulations."

 

Organizational Structure

Item	Content
Board of Directors	The Company's Board of Directors is the highest governing body for risk management. It aims to comply with laws and regulations, promote and implement overall operational risk management, and gain a clear understanding of the risks associated with sustainable operations. The Board ensures the effectiveness of risk management.
Executive Management (Chairman, CEO, or  relevant operational executives)	Responsible for reviewing and managing risk assessments and response strategies for various plans and projects initiated by the respective departments. They provide guidance on risk management.
Audit Unit	This independent unit under the Board of Directors assists the Board and the management in examining and reviewing the deficiencies in internal control systems. It assesses the effectiveness and efficiency of operations and provides timely improvement recommendations. This ensures the continued effective implementation of internal control systems and serves as a basis for reviewing and amending internal control systems.
Business Execution  Units	These units are responsible for frontline risk management in daily operations. Their unit heads analyze, monitor, and prevent relevant risks within their areas of responsibility. They ensure that risk management mechanisms and procedures are effectively implemented.

 

Operation Status

The company actively promotes the implementation of its risk management mechanisms. It conducts risk response planning during regular management meetings and reports on its operations annually to the Board of Directors. The report provided to the Board on December 14, 2022, included explanations of risk assessments, the risk control measures implemented, and the operation status of risk management.

 

 

公司治理主管

　本公司為保障股東權益、強化董事職能及公司治理，本公司已於2023年5月10日董事會通過由財務長余聖芬兼任公司治理主管，負責公司治理之制度設計、規劃及工作執行。