To enhance ICT security and protect the confidentiality, integrity, and availability of information from internal and external threats, the company has established six major areas of security infrastructure and management:

(1) Computer Equipment Security Management

1. All servers and equipment are located in a dedicated server room with access control via card swipes and detailed entry/exit logs. Third-party technicians must be accompanied by IT personnel and logged upon entry.
2. The server room is equipped with independent air conditioning and fire extinguishers suitable for electrical and general fires.
3. UPS (uninterruptible power supply) systems and voltage regulators are installed and connected to the building’s generator to prevent downtime from unexpected power outages.
4. A log server has been implemented to retain critical system logs for over six months, complying with TWSE/TPEx cybersecurity guidance.

(2) Network Security Management

1. Corporate-grade firewalls are deployed at network entry points to block unauthorized access.
2. Site-to-site encrypted connections are used between Taichung, Hsinchu server rooms and Taipei offices to protect data transmissions.
3. Penetration testing and vulnerability scanning are conducted in April and October annually for core systems, and high-risk vulnerabilities are patched promptly.

(3) Anti-Virus Protection and Management

1. All servers and employee terminals are installed with antivirus software that automatically updates virus definitions and detects potentially malicious executable files.
2. Infected devices are isolated or cleaned immediately, and risk reports are generated to facilitate incident response.
3. In 2025, the company plans to introduce endpoint protection and behavioral detection systems to block malicious behavior and prevent ransomware attacks.

(4) System Access Control

1. System access is granted only after formal application and supervisor approval. The IT department assigns user accounts and roles based on submitted requests.
2. Passwords must meet complexity standards and include a mix of letters, numbers, and special characters.
3. Employee account access is revoked upon resignation or leave through coordination with IT.
4. In 2025, the company plans to introduce a Privileged Access Management (PAM) system, requiring pre-authorization, real-time monitoring, and post-operation audit reporting for critical system operations.

(5) Ensuring Stable System Operations

1. Data Backup: Backups are performed regularly. In addition to the main backup at the data center, secondary backups are stored both locally and in Hsinchu.
2. Disaster Recovery Drills: Annual drills are conducted to restore systems from backup media and ensure the accuracy of restored data via user confirmation.
3. Network Redundancy: Two leased lines from telecom providers operate in parallel with bandwidth management to ensure uninterrupted communication.

(6) Cybersecurity Awareness and Training

1. Regular Awareness Campaigns: Employees are reminded to regularly update complex passwords and avoid phishing attacks. Social engineering tests are conducted periodically.
2. Training Seminars: Periodic in-house training sessions are held on information security.
3. Security Resources Investment:
   • Hardware: Firewalls, email anti-virus, managed switches.
   • Software: Backup management software, VPN authentication.
   • Telecom: Multiple lines, host backup, intrusion prevention services.
   • Personnel: Daily system monitoring, weekly backups with offsite storage, biannual security training, annual disaster recovery drills, internal IT audits, and third-party audits.
   • Cybersecurity Staff: A dedicated cybersecurity officer and team manage architecture design, operations, incident response, and policy revisions. The cybersecurity officer reports to the board at least once annually.