Corporate Governance

Cybersecurity Management:

Cybersecurity risk management framework

The Information Department of the Company has already constituted an “Information Security Dedicated Unit” to take general charge of establishment, execution, risk management, and compliance of information security policies. The members of this unit comprise 1 information security officer and 2 information security personnel. The Management Development Center is responsible for regularly supervising the operation of this dedicated unit, confirming the implementation of information security policies, and regularly reporting the management status of information security risk management to the Board of Directors every year (already reported to the Board of Directors on December 19, 2023). Besides, the Internal Audit Office executes the review of cybersecurity management work every quarter. If any insufficiencies that needed to be improved are found, it will not only require the audited units to study and draft relevant improving measures, but also regularly summarize and report the results of review/tracking and improvement to the Audit Committee and the Board of Directors periodically.

Information security policies and specific response plans

Cybersecurity policies

Below are the management principles of the Company’s cybersecurity policies:

• Guarantee that the Company can sustain the confidentiality, availability, and integrity of each operating system under various threats.
• The Company views Personal Data Protection Act, Copyright Act, and Trade Secrets Act as important laws and regulations to follow, and requires all operating levels and every employee to follow them in the work.
• During information risk management, the results of risk assessment must be adopted as basis for the policies, and cost efficiency shall be equally emphasized.
• Important information assets needed for maintenance of corporate operations must be appropriately and practically protected.
• Safety verification must be conducted upon addition and change of information systems to ensure that the designs do not violate the Company’s requirements for information security, and the added or changed systems may go live only after being approved by personnel at an appropriate hierarchy.
• Responsive plans must be formulated to ensure the continual operation of important information services, and drills shall be performed as appropriate to sustain the effectiveness of these plans.
• For the compliance of information security policies and relevant provisions, supervisor of each department is responsible for administrative supervision, and shall guarantee that the information security policies can be practically executed in this department.
• Relevant administrative measures or operating standards shall be developed to standardize the safety management of individual systems and specific issues.
• Close attention shall be paid to evaluating the local and foreign information security standards and requirements that may affect the Company as advance response.
• Prevent the unauthorized, improper access to information assets.
• Guarantee that information assets will not be leaked to any unauthorized third party.
• Establish a business sustainability plan and practice and revise it regularly.

The Company has drawn up Administrative Measures for Information Security for all the colleagues and partners as criteria for use and maintenance of information security management systems, including:

• Personnel safety management
• Computer system security management
• Server security management
• Password security management
• System change management
• System permission management
• Software application management
• Virus and malware prevention and control
• Network connected management
• Regulatory equipment application management
• Storage media backup
• Cybersecurity management
• System access control

When an information incident occurs, evaluation shall be conducted according to the operating procedure for evaluation of security grades of information security incidents, and then the procedure for emergency treatment of information security system shall be performed per the grade.

Specific responsive management schemes for information security protection:

• Network security: Introduce firewall technology and invasion prevention system, execute network access control management, and prevent hacker intrusions and cross-machine spreading of computer viruses.
• Device safety: Establish endpoint anti-virus software to strengthen the detection of malicious software behaviors.
• Application program security: Carry out disaster restoration drills of key application systems every year. The program development is divided into test area and formal area, to reduce error corrections.
• Personnel and physical security: Access control, temperature and humidity testing, and UPS protection are set up at the computer rooms.
• Account and permission management: The permissions are granted only as required by job duties, and shall be regularly reviewed. The permissions for accounts originally held by resigning personnel will be frozen.
• Strengthening of data security protection technologies: Document classification, encrypted control of classified documents, limitation of read-only access to storage devices, and signing of confidentiality agreements with important customers and suppliers.
• Education, training, and advocacy: Improve colleagues’ awareness of information security, advocate the awareness of email social engineering attacks, and conduct information security drills once every year. Strengthen education and training of information security for new colleagues. Select and assign information personnel to participate in information security management courses every year, and encourage colleagues to obtain licenses by participating in relevant examinations.

Cybersecurity risks and countermeasures

The Company has already established relevant procedures to cope with and report information security incidents including “PROCedure for Emergency Treatment of Information Systems” and “SOP for Handling of Major Virus Incidents of the Company”, and implemented network and computer information security protection measures, in the hope that potential information security issues can be promptly addressed. However, since any internal control system has its inherent limitations in controlling risks, and the methods of online technological crimes are constantly changing, the Company cannot guarantee with 100% certainty that its key business systems will be completely protected from any form of cyberattack. Therefore, the Company has actively participated in “Taiwan Computer Emergency Response Team/Coordination Center (TWCERT/CC)” and “Science Park Information Sharing and Analysis Center (SP-ISAC)”, to share cross-domain joint defense and intelligent of local and foreign information security alliances and strengthen each aspect of the Company including process, technology, personnel, products, etc., thus improving the Company’s capability to respond to and handle threats and realizing the goal of blocking threats and quickly replying to service needs.

Quantified data of resources invested in cybersecurity management:

• The Company has already assigned the Information Department to take general charge of establishment, execution, risk management, and compliance of information security policies. The members of this unit comprise 1 information security officer and 2 information security personnel.
• The Company prepares a budget with a fixed percentage (not less than 5% of the total amount of information budget) every year to upgrade and maintain information security related software and hardware. In 2023, the information security related expenses accounted for approximately 7% of the total expenses of the Information Department.
• Information security advocacy is implemented for employees 4 times a year.
• Information security incident handling drills are implemented once every year.