繁體中文 English
圖片

Security

Information Security Policy Statement

To ensure the thorough implementation, effective operation, supervision, and continuous improvement of our Information Security Management System (ISMS), and to safeguard the confidentiality, integrity, and availability of our company’s critical information systems, we hereby establish this Information Security Management Policy.

This policy serves as a clear guideline for all employees in their daily work. Every staff member is obligated to actively participate in the promotion and implementation of the policy to ensure the secure and stable operation of our personnel, data, information systems, equipment, and networks. We expect all staff to understand, implement, and maintain the policy to achieve the goal of uninterrupted information operations. For detailed regulations on using general IT equipment and network services, please refer to “ISMS-W-001: General IT Equipment Security Management Procedures.”

1. Enforce Information Security to Enhance Service Quality

All employees are responsible for implementing the ISMS. All information-related measures must ensure the confidentiality, integrity, and availability of business data. This includes protecting against external threats and improper internal management that may lead to data breaches, damage, or loss. Appropriate security measures must be selected to reduce risk to an acceptable level. Continuous monitoring, review, and auditing of the information security system will help improve service quality and raise service standards.

2. Strengthen Training to Ensure Continuous Operations

We supervise all staff in fulfilling information security responsibilities. Ongoing and appropriate security training is conducted annually to instill the concept that “Information security is everyone’s responsibility.” This raises awareness of the importance of information security and ensures compliance with related policies. The goal is to enhance awareness, response capability, and reduce security risks to support continuous business operations.

3. Establish Emergency Response and Swift Disaster Recovery

Emergency response and disaster recovery plans are created for critical information assets and key business functions. Regular drills of emergency response procedures are conducted to ensure rapid recovery in case of system failure or major incidents. This ensures the continuity of essential operations and minimizes potential losses.

4. Proper Use of Personal Data and Prevention of Data Breaches

Encryption and secure measures are used for the transmission and sharing of personal data. Regular evaluations of contractors’ compliance are conducted, and agreements are signed to ensure data security. Staff training is reinforced to increase awareness of data protection. Monitoring and review mechanisms are established to oversee the use, access, and transmission of personal data, and to detect and respond to any abnormal activities or security events in a timely manner. Personal data is securely and permanently deleted when no longer needed.