Information Security Policy

Purpose of Information Security Risk Management:
Strengthen information security management; ensure the confidentiality, integrity, and availability of information; maintain the reliability of information equipment (including computer hardware, software, and peripherals) and network systems; and raise employees' awareness of information security. Protect these resources from interference, damage, intrusion, and any other harmful acts or attempts.

Information Security Risk Management Organization:
The Information Security Promotion Task Force coordinates, plans, audits, and promotes information security management, serving as a cross-departmental information security body. In the event of significant organizational changes, such as restructuring or major business changes, the applicability of this policy will be reassessed. This policy will be revised as appropriate in accordance with assessment results, relevant laws and regulations, and the latest developments in technology and business to ensure it meets actual needs.

Information Security Promotion Task Force:
The task force comprises the heads of each department, with the General Manager serving as its convener. If a member changes roles, a replacement must be appointed immediately and a handover completed.

Allocation of Information Security Responsibilities:
The head of the Information Technology Department appoints IT personnel to serve on the Information Security Incident Response Team. The team is responsible for developing, implementing, and evaluating information security guidelines, plans, and technical standards, as well as carrying out information security operations, including preventive measures and incident handling. The Audit Office is responsible for protecting confidential information and conducting security audits.

Information Security Protection and Control Measures:
Based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), the company safeguards information security through six steps: Identify, Protect, Detect, Respond, Recover, and Train.

Step 1 — Identify: Understand the organizational environment, critical resources, and services; conduct risk assessments and establish risk management strategies aligned with daily operations.
Step 2 — Protect: Plan and implement safeguards to ensure critical resources and services are protected from information security incidents.
Step 3 — Detect: Establish mechanisms for real-time detection and alerts for cybersecurity incidents, and regularly update systems and antivirus definitions.
Step 4 — Respond: Maintain effective internal and external communication channels to manage security incidents, including investigation, digital forensics, and improvement recommendations.
Step 5 — Recover: Develop data backup and recovery plans to restore normal operations as quickly as possible.
Step 6 — Train: Information security is everyone's responsibility. Continuously strengthen employees' information security awareness.

Information Security Implementation Plan:

I. Personnel Management and Information Security Training:
1. Conduct security assessments for IT-related positions and duties. Carefully assess candidates' suitability during recruitment, work assignment, and task allocation, and perform necessary evaluations.
2. Provide information security awareness guidance tailored to management, business, IT, and other job functions to build employee awareness and improve overall security.

II. Computer System Security Management:
1. Before outsourcing IT services, define information security requirements and specify the vendor's security responsibilities and confidentiality obligations in the contract; require the vendor to comply.
2. Copy and use software in accordance with applicable laws, regulations, and contracts, and establish software-use management procedures.
3. Implement necessary preventive and protective measures to detect and prevent computer viruses and other malware and ensure normal system operation.

III. Network Security Management:
1. For information systems accessible from external networks, select appropriate security technologies and measures based on the importance and value of the data and systems. These may include encryption, identity authentication, electronic signatures, firewalls, and vulnerability scanning to prevent intrusion, damage, alteration, deletion, and unauthorized access.
2. Use firewalls and other necessary security controls at network connection points to manage data transfers and resource access between external and internal networks. Regularly review firewall settings and activity logs, and have them checked by the appropriate manager.
3. Assess data classification before publishing or distributing information via the Internet or World Wide Web. Confidential or sensitive information, and personal or private data and documents published without the data subject's consent, must not be posted online.
4. Regularly update antivirus software, schedule automatic virus scans, and train all personnel to use antivirus software to prevent external malware infections.
5. Establish email-use rules. Confidential data and documents must not be transmitted by email or other electronic means.
6. Disable unnecessary network services. Every network service must be requested and approved by the responsible manager before IT personnel enable it.

IV. System Access Control:
1. Establish system access policies and authorization rules, and inform employees and users of their permissions and responsibilities in writing, electronically, or by other means.
2. Immediately revoke all access to information resources when employees leave or take leave as applicable, and include this in the required offboarding procedures. When employees change roles or transfer, adjust their permissions within the specified period according to system access authorization rules.
3. Establish a system-user registration and management process and strengthen password management. As a general rule, passwords should be changed at intervals not exceeding three months.
4. Strengthen security controls for service providers who remotely log in to maintain systems. Maintain a list of such personnel and require them to comply with relevant security and confidentiality obligations.
5. Establish an information security audit system and conduct audits regularly or as needed.

V. System Development and Maintenance Security Management:
1. For systems developed internally or by external contractors, consider information security requirements from the initial stage of the system life cycle. Apply security controls to maintenance, updates, production deployment, and version changes to prevent improper software, backdoors, computer viruses, and other threats.
2. Define and restrict the systems and data that vendor personnel responsible for software/hardware implementation and maintenance may access. Do not issue long-term system IDs or passwords. If operational needs require temporary credentials, issue them for a limited period and revoke access immediately after use.
3. Vendors implementing or maintaining critical software or hardware facilities must work under the supervision and accompaniment of relevant company personnel.

VI. Information Asset Security Management:
1. Maintain an inventory of information assets related to information systems, specifying asset types, owners, and security classifications.
2. Establish corresponding safeguards in accordance with applicable rules on company confidential information, personal data processed by computers, and disclosure of company information.
3. Label output data from information and systems classified by security level with the appropriate classification to guide users.

VII. Physical and Environmental Security Management:
Establish physical and environmental security measures covering equipment placement, surrounding environments, and access control for personnel.

VIII. Business Continuity Planning and Management:
1. Establish a business continuity plan; assess the impact of human-caused and natural disasters on operations; define emergency response and recovery procedures and responsibilities; and regularly conduct drills and update the plan.
2. Establish an emergency response mechanism for information security incidents. When an incident occurs, promptly notify the IT department or responsible personnel according to established procedures, take response measures, and contact the relevant law-enforcement and investigative authorities for assistance as needed.
3. Classify data security levels in accordance with applicable laws and regulations, and implement appropriate and sufficient information security measures for each level.

Major Information Security Management Measures Implemented:

Item	Specific Management Measures
Firewall Protection and Control	Firewall connection rules are configured to allow only basic Internet access and email services by default. Special connection requests must be approved by both the department manager and the head of the IT Department before access is enabled. Firewall network connections are monitored continuously.
IT Server Room Security Controls	The server room is secured by a locked door and requires a key for entry; unauthorized access is prohibited. An uninterruptible power supply (UPS) keeps equipment powered during an unexpected outage until the building generator starts, allowing IT staff time to take follow-up action. Server room inspection logs record temperature and humidity as well as the status of servers and network equipment.
Antivirus Software Controls	The company uses a centralized management server to monitor and manage enterprise endpoint antivirus software. All user computers must have the endpoint antivirus software installed, and virus definitions must be updated regularly to reduce the risk of infection.
Email Security Controls	The email server provides active email scanning and threat protection to identify unsafe attachments, phishing messages, spam, and emails containing malicious links before users receive them. After emails reach users' computers, antivirus software also scans for unsafe attachments. The email server retains backup copies of all incoming and outgoing email data.
Data Backup Controls	Information system programs and databases are fully backed up daily, with an additional copy stored on a NAS backup server. Files from all departments are stored on a file server and centrally backed up by the IT Department to the NAS backup server. Each week, backup data is copied to portable hard drives and handed to Administration Department personnel for off-site storage. Versioning and access permissions for important documents are managed through the document management system, while servers and data are replicated to separate locations at different factories for disaster recovery.

Resources Allocated to Information Security Management:

Item	Specific Resources Allocated
Information Security Protection Investment	As part of its information security threat and risk management solutions, the company enters into annual maintenance and operations agreements with service providers. These cover dedicated network lines, antivirus and anti-hacking protection, and maintenance of various servers, with an annual cost of approximately NT$3,700,000.
Internal Training	The IT Department conducts one training session each month. Topics include shutting down all systems during an unexpected power outage; backing up and restoring NAS, ERP, virtual machine, electronic approval, and email server systems; information security case awareness; server-room fire protection drills; antivirus and anti-hacking case awareness; failover to backup networks; replacing failed server hard drives; and switching to backup dedicated network lines. As of December of the current year, a total of 12 internal training sessions have been conducted.
External Training	As information and network technologies continue to evolve, IT personnel participate in information and network security seminars and training sessions from time to time to strengthen their security awareness and knowledge. As of December of the current year, they had attended a total of three seminars or training sessions.
Information Security Officer	On November 12, 2025, the Board of Directors approved a change in the Information Security Officer, appointing Director Chang Fu-Ming to the position.