Risk management framework for information and communications security:

The Company’s information security team is subordinate to the information department, responsible for reviewing the Company’s information security policy, supervising the operation of information security management, confirming the effectiveness of the Company’s information security management operation, and establishing a good awareness of information security among colleagues. The internal audit team regularly conducts work audits, submit audit reports, and reports to the Audit Committee and the Board of Directors.

Information security policy:

1. Purpose:
   The Company’s information security policy mainly focuses on information security governance and legal compliance. Raising information security protection capability on the whole to ensure customers’ information, and the Company’s intellectual property creation is not infringed. The risk associated with internal and external information security in the Company could be reduced. The Company’s information security team is responsible for expanding information security management, setting management goals, continuing to strengthen monitoring and control, and management of the mechanisms, including strengthening educational training, information security structure design, and assuring that all of the information processes meet the legal requirements of domestic and overseas information security laws.
2. Scope:
   To prevent the misuse, leakage, tampering, or damage of data resulting from negligence, intentional misconduct, or natural disasters, which could pose various potential risks and threats to the Company, the scope of information security is covered by the following procedures:
   1. Formulation and Evaluation of Cybersecurity Policy
   2. Cybersecurity Organization
   3. Cybersecurity Human Resources Security
   4. Cybersecurity Asset Management
   5. Physical and Environmental Security
   6. Access Control Security
   7. Communication and Operations Security
   8. Operation Security Management
   9. Outsourcing Management
   10. Data Backup Management
   11. Response and Treatment of Cybersecurity Incidents
   12. Sustainable Business Operation Management
   13. Information Security Policy Compliance Management
3. Management Measures:
   The proposed information security plan is to promote information security policy year by year, to introduce information security system and process specification, and to continuously establish complete information security technical protection measures. The summary of information security management measures is as follows:

4. Objectives:
   • Through the management and control of the aforementioned scope of information security, combined with preventive and recovery control measures and procedures, the Company aims to achieve its operational stability and continuity, to prevent disruptions in business activities, and to reduce the risks that could lead to operational disruptions to an acceptable level.
   • The Company continuously conducts information security education and training to enhance employees’ information security awareness, and strengthen their understanding of related responsibilities, ensuring the confidentiality and integrity of information while safeguarding the privacy of employees, business operations, and customer data.
   • The Company establishes an Information Security Business Continuity Plan and execute information security activities in compliance with relevant laws or regulations.