I. Information Security Management Strategy and Framework:

(1). Information Security Organizational Structure and Responsibilities

1. Information Security Committee:
   • Responsible for resolutions on matters related to the information security management system.
   • Convenes meetings regularly each year or as needed to review matters related to information security management.
2. Chief Information Security Officer and Convener:The Information Security Committee has one Chief Information Security Officer who also serves as Convener.
   • Responsible for reviewing matters related to the deliberation, establishment and evaluation of information security policies, plans and technical specifications, as well as information security education and training.
   • Convenes cross-group resource coordination meetings as needed and is responsible for coordinating the allocation of resources required to implement the information security management system.
3. Information Security Officer:A dedicated person designated by the Information Security Committee.
   • Responsible for coordinating information security-related operations of the Information Security Team and the Emergency Response Team.
   • Responsible for early warning and monitoring of the information security status, and for handling information security conditions and incidents.
   • Proposes recommendations for improving information security management and assists in carrying out information security self-assessments.
4. Information Security Team:Composed of personnel designated by the Information Security Committee and responsible for planning and executing information security operations.
   • Establish regulations related to information security management.
   • Promote information security-related activities.
   • Conduct information security-related education and training.
   • Establish a risk management system and carry out risk management.
   • Establish emergency response and recovery measures for security incidents.
   • Implement audit improvement recommendations.
   • Implement improvements to preventive measures.
   • Study new information security products or technologies.
   • Execute resolutions of the Information Security Committee.
   • Identify laws and regulations related to information security.
   • Identify requirements of laws, regulations and contracts related to information security, and review and update them regularly.
5. Emergency Response Team:The Emergency Response Team is a task-based team; the responsibilities and duties of its members are described as follows:
   • (1) Convener
     • When a major information security incident occurs, responsible for contacting and convening the Emergency Response Team.
     • Coordinates and supervises the owners of each critical business process in carrying out operations, and coordinates the deployment and use of resources.
     • Based on the results of the incident assessment and the current situation, may recommend that the Convener of the Information Security Committee decide whether to declare a disaster and activate the business continuity plan.
     • When a disaster occurs, cooperates with rescue units in rescuing personnel, supplies and equipment, and directs on-site operations.
     • Responsible for post-disaster coordination and directing the clean-up of the disaster site.
     • Responsible for planning on-site recovery work at the original operating site.
   • (2) Owners of Each Critical Business Process
     • Responsible for convening relevant personnel to develop, maintain, update, revise and execute each disaster recovery procedure.
     • Responsible for convening relevant personnel each year to conduct testing and drills of the business continuity plan.
     • Responsible for response, handling, recovery and operational testing at the original operating site or the off-site backup site.
     • Responsible for collecting evidence at the disaster site to facilitate future litigation and damage claims.
     • Assesses damage at the disaster site and carries out on-site recovery work at the original operating site.
6. Information Security Audit Team
   • Draw up the information security audit plan.
   • Conduct information security audits.
   • Prepare information security audit reports.
   • Track the implementation of improvements for nonconformities.

(2) Information Security Policy

1. Objectives

   To maintain the confidentiality, integrity and availability of the Company's information and to safeguard the privacy of user data, the Company aims to achieve the following objectives through the joint efforts of all employees:

   • Protect the Company's business information from unauthorized access to ensure its confidentiality.
   • Protect the Company's business information from unauthorized modification to ensure its accuracy and integrity.
   • Establish the Company's business continuity plan to ensure the continuous operation of the Company's business services.
   • Ensure that the execution of all of the Company's business services complies with the requirements of relevant laws or regulations.
2. Principles
   • All employees shall fully understand the purpose of this policy and their responsibilities.
   • Department heads shall be responsible for supervising, implementing and auditing compliance with this policy and related operating rules.
   • Information assets of critical business shall be inventoried and classified regularly; risk assessments shall be performed on important information assets, and appropriate protective measures shall be implemented accordingly.
   • Internal employees and outsourced vendors shall handle information operations in accordance with prescribed procedures and designated measures.
   • Internal employees and outsourced vendors shall report information security incidents and information security weaknesses through appropriate reporting mechanisms.
   • Any person who acts to endanger information security shall be held liable under civil, criminal and administrative law and subject to relevant disciplinary action, depending on the severity of the case.
   • Regularly review the effectiveness of the information security management system.

(3) Management Review Meeting

1. The Information Security Committee convenes a management review meeting at least once a year, and may convene extraordinary meetings when necessary.
2. The management review meeting covers:
   • Review and adjustment of the information security policy
   • The status of actions from previous management reviews.
   • Changes in internal and external issues relevant to the information security management system.
   • Feedback on information security performance, including the following items:
     • Nonconformities and corrective actions.
     • Monitoring and measurement results.
     • Audit results.
     • Achievement of information security objectives.
   • Feedback from interested parties.
   • Results of risk assessment and status of the risk treatment plan.
   • Opportunities for continual improvement

II. Specific Management Programs:

1. (1) Information Assets
   • Information equipment and media management: including computer equipment, peripheral equipment, network equipment, general office machines, laptop computers, tablet computers, smartphones, mobile devices, optical discs, USB flash drives, various memory cards and removable storage devices.
2. (2) Risk Assessment
   • Risk evaluation
   • Risk treatment
3. (3) Physical and Environmental
   • Server room management
     • Control measures
     • Equipment security
     • Security maintenance of hardware information assets
     • Security maintenance of information server room equipment
4. (4) Communications and Operations
   • Firewall management
   • Server security management
   • Vulnerability management
   • Backup management
   • Software management
5. (5) Access Control
   • Account and password management
6. (6) Information Security Incidents
7. (7) Business Continuity
   • Business process impact analysis
   • Business continuity plan drills
8. (8) Information Security Audit
9. (9) Information Security Human Resources
   • Education and training
   • Outsourcing management
10. (10) System Development and Maintenance

III. Resources Invested in Information Security Management:

1. (1) Server Room Upgrades and Maintenance
   • Dual high-availability firewalls
   • Layer 3 switches
   • Replacement of dedicated air conditioning
   • UPS replacement
   • Full replacement with safety-compliant PDUs
2. (2) Education and Training
   • At least 2-3 information security training sessions for all employees each year
   • Information security awareness documents sent to all employees every six months (via e-mail)
3. (3) Actual Drills of Business Continuity Operations
4. (4) At Least One Information Security Management Review Meeting Held Each Year
5. (5) One Internal Audit and One External Audit Conducted Each Year