The Company has established an information security office since September 1, 2022, with a dedicated supervisor (division director) and a dedicated information security specialist, and the president/CEO (the former Chief Operating Officer) serves as the convener of the information and cyber security management team. In addition to the information security office, the information and cyber security management team includes MIS center, internal audit office, HR office, legal office, and independent fair executives (management levels of various business divisions and functional units) with the relevant expertise and knowledge, responsible for coordinating, planning, executing and analyzing information and cyber security incidents, and evaluating information and cyber security policies at least once a year.
- The Information Security Office is responsible for establishing the Company's information security policies, strategies and projects, and proposing information security sustainability plans, loss prevention and fraud prevention, and privacy protection to protect employees, information assets and technology.
- The MIS Center and the Legal Office cooperate with the policies, strategies and projects proposed by the Information Security Office, and are responsible for handling information security related plans, measures and technical specifications, as well as research, construction and evaluation of security technologies.
- The HR office is in charge of the employment security assessment.
- The Internal Audit office shall work with the Information Security Office, MIS Center, and related units to take charge of the maintenance of information confidentiality and management matters for audit use.
- The Legal Office is responsible for the review of the project contract, and provides timely publicity, training and education on the laws and regulations of information ethics, including but not limited to privacy, accuracy, property, and accessibility.
- The Independent Fair Executives (management level of various divisions and functional units) shall be in charge of the research on the need for the data, information and cyber system security, and access management and protection thereof, as well as authorization recommendations, assessments and managements of personnel who can use confidential and sensitive data management.
Information and Cyber Security Policy
The so-called information and cyber security policy maintains the regular operation of the Company without violating local regulations, ethics and cultural norms, adopts necessary and cost-effective management, controls risks within an acceptable level, and uses safety protection means, measures or mechanisms, such as operation control and technology tools, to precisely protect the Company’s information assets from any unfair use, disclosure, tampering, theft or destruction, and take the necessary responsive actions promptly and recover normal operations immediately in the event of emergencies, such as malicious attacks, destruction or unfair use, and mitigate the damage caused by the incident that can potentially affect and compromise the Company’s operations. For details, please refer to the "Information and Cyber Security Policy and Management Regulations" published on the Company's official website.
Information and Cyber Security Management
The Company has formulated the following management aspects in the "Information and Cyber Security Policy and Management Measures" promulgated:
- Enactment of and evaluation on the information and cyber security policy
- Information and cyber organization and responsibilities
- Classification of and control over information assets
- Personnel safety management
- Tangible and environmental security management
- Communication and operating management
- Access control
- System development and maintenance
- Continuing operation management
- Information and cyber security policy compliance testing.
Education and Training for Information and Cyber Security Supervisor and Dedicated Personnel in 2023
| Organizer | Name of Course/Activity | Date | Hours | Participant | Certificate |
|---|
| Taiwan Corporate Governance Association |
Practical Aspects of Information Security Governance: Analysis of Key Management Issues- International Trends in Information Security Governance
- Key Performance Indicators in Information Security
- Information Security Management Dashboard
- Industrial Control System Security Management
- Innovative Perspectives on Information Security
|
2023/02/07 |
3 |
- SHIA,CHIEN-CHUNG (@Steve Shia) (Director of Information Security Office)
- LIN,YI-MIN (@Vincent Lin) (Deputy Manager of Information Security Office)
|
- Taiwan Corporate Governance Association Training Certificate- TCGA11200070
- Taiwan Corporate Governance Association Training Certificate- TCGA11200071
|
| iSpan International Inc. |
SSCP (Systems Security Certified Practitioner) Training Course- Fundamentals of Information Security
- Access Control and Authorization
- Identity Authentication
- Management Practices and Security Operations
- Risk Identification, Monitoring, and Analysis
- Information Security Incident Response and Recovery
- Business Continuity and Disaster Recovery Planning
- Cryptography
- Network and Communications Security
- Network Security Defense Techniques
- Cloud Computing and Virtualization Security
- Network Attacks and Malicious Code
|
2023/08/19~20
2023/08/26~27 |
30 |
SHIA,CHIEN-CHUNG (@Steve Shia) (Director of Information Security Office) |
iSpan International Inc. Achieving Certificate- 112-SE200685 |
| Information Service Industry Association of R.O.C. |
Practical Course on Cyber Warfare Techniques: Principles and Practices of DDoS Attacks- Definition of DoS & DDoS
- DoS/DDoS Attack Architecture and Methods
- Defense Mechanisms and Improvement Measures for DoS/DDoS
- Black Market Industry and Case Studies of DoS/DDoS
- Sharing of IoT Security Issues
|
2023/11/23 |
3 |
SHIA,CHIEN-CHUNG (@Steve Shia)(Director of Information Security Office) |
Information Service Industry Association of R.O.C. Achieving Certificate-11226006 |
Procedures of Information and Cyber Security Incident Notification
In 2022 and 2023, the Company did not incur any losses or experience any impact on operations, reputation, etc., due to significant cybersecurity incidents. The report on cybersecurity risk management for 2023 was submitted to the Sustainable Development Committee and the Board of Directors on January 31, 2024, as detailed in the attached
