Risk Management
Information Security Management
1. Information Security Risk Management Framework and Specific Management Programs
(1) Appointment of a Chief Information Security Officer
- Responsible for resolutions on matters related to the information security management system.
- Convenes meetings annually on a regular basis or as needed to review matters related to information security management.
- Responsible for reviewing matters related to the deliberation, establishment and evaluation of information security policies, plans and technical specifications, as well as information security education and training.
- Convenes cross-team resource coordination meetings as needed, and is responsible for coordinating the allocation of resources required to implement the information security management system.
(2) Information Security Team
(2-1) Information Security Planning Group
- Formulates regulations related to information security management.
- Promotes information security-related activities.
- Organizes information security-related education and training.
- Establishes a risk management system and carries out risk management.
- Establishes emergency response and recovery measures for security incidents.
(2-2) Information Security Operations Group
- Implements audit improvement recommendations.
- Implements improvements to preventive measures.
- Studies new information security products or technologies.
- Executes resolutions of the Information Security Committee.
(2-3) Information Security Audit Team
- Drafts the information security audit plan.
- Conducts information security audits.
- Prepares information security audit reports.
- Tracks the implementation of improvements for nonconformities.
- Identifies laws and regulations related to information security.
- Identifies the requirements of laws, regulations and contracts related to information security, and reviews and updates them regularly.
2. Information Security Policy
To maintain overall information security and establish a secure and trustworthy operating environment, ensuring data security, system security, equipment security and network security, and safeguarding the rights and interests of the Company's employees and external personnel.
3. Resources Invested in Information Security Management
- ISO27001 certified by SGS
- Hypervisor platform management software