Information Security Management

Information Security Organizational Structure

Our company has established a dedicated Information Security Team responsible for managing information security and personal data incident crises. The system architecture under the jurisdiction of the Information Security Team comprises four main components: Network Security, Computer Security, Physical Security, and the Information Security Monitoring Platform. The responsibilities of the Information Security Team include formulating relevant policies and procedures, building and maintaining systems, regularly testing systems, conducting education and training sessions, and handling information security incidents.

System Architecture Composition

Information Security Management Policies and Measures

Five Major Information and Communication Security Policies

Ensure the security of company data, systems, equipment, and network communications to block external intrusions and disruptions.
Ensure that access rights to system information accounts and system changes are authorized through the company’s established procedures.
Implement destruction procedures to prevent accidental data exposure and leakage from discarded computer storage media.
Monitor the security status and activity records of information systems to effectively manage and address information security incidents.
Maintain the availability and integrity of data and systems to ensure normal operations can be resumed in the event of a disaster or damage.

Developing Specific Management Plans and Allocating Resources

Our company regularly reviews internal information security standards and builds a risk management framework for information security. When planning the promotion of information security and allocating related resources, we consider information security policies and objectives to provide the necessary resources for establishing, implementing, maintaining, and continuously improving the information security maintenance plan.

Information Security Management Measures

Management Measure	Description
Establish Management Methods	Develop information security management methods, including “IT-001-01 Information Security Management Method” and “IT-002-01 Information Access Rights Guidelines”.
Regular Drills	Plan and conduct regular social engineering tests and drills, and core system backup and recovery drills annually.
Education and Training	Information colleagues participate in information security technical training courses annually. New employees receive basic information security awareness training upon joining. All employees receive annual information security awareness emails and company-wide information security training.
Deploy and Maintain Information Security Management Systems	Includes firewalls, network switches, endpoint protection, Google Workspace Security, and the Dingxin Enterprise Maintenance Service Cloud Management Platform.

Information Security Incident Reporting Procedures

Incident Reporting

When information system users from various units confirm the occurrence of an information security incident, the IT system responsible person must report the facts to the company’s superior within 30 minutes and provide timely updates on the handling progress.

Establishing and Managing Records

After assessing the impact scope, establish management records. The Information Security Team must conduct an investigation of the information security incident, assess the incident level, and request support if it is determined that independent recovery is not possible.

Emergency Response

Propose, decide, and implement emergency response measures, and confirm the results of the handling.

Lifting Management Records

When the system resumes normal operation, the information unit must notify relevant units to lift the management records and complete the “IT-001-01-h Information Security Incident Report Form” for record-keeping.

Level	Incident Status
A	All critical systems interrupted
B	Several critical systems interrupted
C	Single critical system interrupted
D	Causes a temporary business interruption but no recovery required
E	Control failure, but does not affect business operations, injuries, or losses

ESG