1. Purpose:

   1.1 To strengthen the company's information security and ensure the continued normal operation of important assets such as data, systems, equipment, and networks, the company has established the "Information Security Policy".

 2. Applicable objects:

   2.1 All employees of the Company are required to abide by this Policy.

 3. Information Security Objectives:

   3.1 Ensure the confidentiality, integrity and availability of the company's information systems to enable the company to operate continuously and uninterruptedly.

 4. Information Security Control Measures:

• 4.1 Follow the management methods of the information system management procedures to establish a reliable and secure information system.
• 4.2 Backup and disaster recovery drills must be carried out for critical information systems to maintain their availability.
• 4.3 The company must establish an information security system on its external network to strengthen information security protection.
• 4.4 Computers used by employees must be subject to appropriate information security protection controls.
• 4.5 Appropriate control mechanisms should be established for relevant accounts held by employees.
• 4.6 The company must provide annual education and training on IT disruption and information security awareness to personnel who are at high risk of using email.
• 4.7 A list of software used by the company must be established for management, and employees are strictly prohibited from using unauthorized or pirated software.
• 4.8 Establish an information security team to regularly report to management on the implementation of information security.
• 4.9 The Company shall prepare an annual budget for the information security system and implement system upgrades or improvement plans to strengthen information security protection.

 5. Review and Revision:

   5.1 This Information Security Policy will be reviewed and revised annually and announced.

Information Security Management Framework

 Improve Defense Capabilities

• Strengthen external access control (two-factor)
• Establish a spam filtering system
• Install a multi-layered anti-virus system
• Build an external attack defense system
• Perform a vulnerability scan

 Information Security Management

• Account permission management
• Host system protection
• Computer room security management
• Firewall construction and management
• Data access control
• Endpoint protection management
• System backup management

 Potential Risk Control

• Conducting email social engineering drills
• Establishment of a cybersecurity team to strengthen cybersecurity defense
• Conduct education and training to enhance information security awareness
• Conduct disaster recovery plan drills

 Compliance with laws

   We follow the guidelines for information security management of listed companies, allocate budgets annually to gradually implement system upgrades and improvement plans, and strengthen information security protection.