Information Security Policy

 

  (1)Information Security Policy：

      1.Implementation of the three core objectives of information security:

        a. Confidentiality: Ensure that only authorized personnel can access information。

        b. Integrity: Ensure that information content and processing methods are accurate and consistent。

        c. Availability: Ensure that authorized users can obtain information and use systems/equipment when required。

      2.All data access must follow departmental and individual access rights in accordance with operational management regulations

      3.Ensure the continuous operation of information systems and implement effective measures to reduce various information security risks.

 (2)Information and Communication Security Risk Framework:

      1.The Information Technology Department is responsible for executing, promoting, implementing, and planning information security policy management, as well as handling and reporting information security-related incidents。

      2.Mechanisms for antivirus, disaster recovery, anti-hacking, and data leakage prevention shall be established, with regular reporting to senior management。

  (3) Specific Management Measures:

      1.Endpoint protection and control: Install antivirus software, keep operating systems updated, and ensure that all devices connected to the network—or maintained by information service providers—undergo technical security assessments and obtain approval from authorized managers before being put into use。

      2.Centralized external control: Establish network security planning and management procedures, and implement a next-generation firewall (NGFW) security platform(Firewall)

      3.Data protection: Critical data must be backed up using off-site and cross-platform storage. Confidential or sensitive data/documents shall not be stored in publicly accessible information systems。

      4.Adoption of new information technologies: Before introducing or enabling new IT (e.g., software, hardware, communications, or management measures), a security assessment must be conducted to evaluate protection measures and compliance levels. Formal administrative approval from the responsible manager must be obtained prior to use

      5.Awareness and training: The Company provides regular information security training and awareness programs to employees, strengthening cybersecurity awareness and reinforcing information security defenses。