Information Security Management

Corporate Governance

Information Security Management

With the development of technology, the information security risks faced by enterprises are increasing day by day. The company also pays attention to this issue. To strengthen information security management, protect security of computer information data, systems, equipment and networks of the company, prevent the improper use, leakage, alteration and destruction of information assets due to human negligence and deliberate sabotage, which may affect the normal operation of the computer operating system or damage the operations of the company, the company formulates relevant policies for all colleagues to follow, and at the same time promotes it from time to time to enhance employees’ awareness of information security. Please refer to the Information and Communication Security Management Policy.


Management Framework

To ensure the confidentiality, integrity, and availability of information assets and reduce operational risks, a cyber security risk management framework has been established. Overall cybersecurity risk control and internal audits are regularly reported to the board to enforce top-level oversight. In practice, a cyber security committee composed of top executives from each department has been established, with the following organizational roles and responsibilities.

  • Convener

    The president, responsible for approving security policies, goals, and scope. Meets at least once a year to ensure alignment of security strategies, review major security incidents, and allocate resources.

  • Chief Cyber Security Officer

    The head of the IT department, responsible for coordinating and overseeing overall security management, including policy implementation, audits, and cross-department collaboration. Reports regularly to the committee.

  • Committee Members

    Department managers who assist in planning, implementation, and providing expert opinions based on their business units.

  • Security Working Groups

    Three specialized groups: Incident Response Team: Handles real-time response, reporting, investigation, and recovery of security incidents. Management Team: Maintains daily security policies, conducts training, and promotes awareness. Audit Team: Performs internal audits periodically or as needed, reviews compliance, and recommends improvements.


Cyber security policies

Our company’s cyber security management system complies with the international ISO 27001 standard and the Cyber Security Guidelines for Taiwan Listed Companies, and has obtained the ISO/IEC 27001:2022 Information Security Management System certification, with the certificate validity period spanning from October 29, 2026, to October 29, 2029. The core objective of our policy is to ensure the confidentiality of information assets, maintain their integrity and accuracy, and guarantee their availability. Through regular reviews and risk assessments, we engage in continuous improvement to achieve comprehensive information protection and compliance with relevant regulations.


Concrete management programs

Continuously building a resilient cybersecurity protection system with specific management mechanisms and strategies implemented as follows.

  • External Threat Intelligence and Cyber Defense Collaboration

    Join the Taiwan Computer Network Emergency Response Team/Coordination Center (TWCERT/CC). Through information sharing among industry, government, academia, and research, stay updated on the latest domestic and international threats to enhance joint defense and response capabilities.

  • Vulnerability management and patching process

    Establish a workflow from detection, verification, risk prioritization to remediation, prioritizing high-risk vulnerabilities based on CVSS to ensure critical system security.

  • Cyber Risk Management and Asset Inventory

    Based on international standards and internal policies, conduct annual internal cybersecurity audits and risk assessments. Identify key business functions and information assets, perform system inventories and vulnerability analyses, and manage risks by classification to ensure continuous improvement.

  • Network perimeter and endpoint security control

    Implement a defense-in-depth strategy with strict traffic inspection and threat blocking at the network perimeter. Enforce rigorous endpoint security policies, fully controlling USB and other external storage device usage. Apply encryption and access controls for sensitive corporate data access and transmission. Supplement with advanced email screening to prevent external attacks and internal data leaks from the source.

  • Access Control and Authorization

    Implement the principle of least privilege and deploy multi-factor authentication (MFA) for critical internal information systems to enhance identity security. Regularly review system account permissions and monitor access behavior to effectively prevent unauthorized login and access risks.

  • System Development and Maintenance Security

    Application system development follows the Software Development Life Cycle (SDLC) standards. Security measures are integrated during the development phase to reduce potential application vulnerabilities from the start, ensuring system security before deployment.

  • Outsourced Supply Chain Security Management

    Establish cybersecurity risk control mechanisms for information service vendors. Specify security service levels (SLA) in contracts and require non-disclosure agreements (NDA) for all outsourced tasks to define vendors’ security responsibilities. Implement independent account issuance and secure remote access controls for daily operations and system access to prevent unauthorized activities, ensuring supply chain security.

  • Business Continuity and Disaster Recovery

    Establish a comprehensive Business Continuity Plan (BCP) with backup and recovery strategies for critical systems. Implement standardized procedures to quickly respond to incidents and minimize operational disruptions.


Resources Invested in Cyber Security Management

To implement various cybersecurity management plans, an annual budget is continuously allocated for hardware and software upgrades, system testing, and staff training, with specific resource investments as follows:

  • Multi-layered network and endpoint protection

    Implemented Chunghwa Telecom cybersecurity cloud services at the network perimeter, integrating next-generation firewalls (NGFW), intrusion prevention systems (IPS), and data encryption technologies. All company endpoints have antivirus and monitoring software installed. Advanced email filtering and auditing systems are deployed to block malicious emails, alongside comprehensive document encryption to secure confidential files. Additionally, MDR (Managed Detection and Response) services combined with SIEM enable continuous network security monitoring.

  • Active Technology Testing and Protection Enhancement

    Following the Continuous Threat Exposure Management (CTEM) framework, resources are allocated to conduct penetration testing and automated vulnerability scanning. The effectiveness of active testing and vulnerability remediation in 2025 is as follows:

    ­Host environment inspection: All issues have been addressed and controlled according to standards. For items that cannot be directly patched due to system-level limitations, alternative network isolation and protection enhancements have been implemented.

    ­Web app testing: project tracking and risk mitigation are fully implemented. For custom development items, network layer protection rules are proactively deployed to block potential attacks (virtual patching), effectively reducing external exposure.

  • Business Continuity and Disaster Recovery (BCP/DR)

    Establish high availability (HA) architecture and hybrid cloud backup for critical core systems, set clear Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), and conduct at least one disaster recovery drill annually to validate backup effectiveness.

  • Cybersecurity Training and Awareness

    In 2025, our company conducted a total of 762 hours of cybersecurity training. Cybersecurity education is mandatory for all employees annually, including awareness campaigns and social engineering drills. The training covers key topics such as security policies, password management, and phishing prevention. Through diverse awareness efforts and assessments, we strengthen employees' security awareness to build the first line of defense for the company.