Establish regular inventories of information assets and personal data, conduct risk management based on information security and personal data risk assessments, and implement various control measures.
Annually conduct information security and personal data protection training and awareness programs. All new employees are required to sign an information security confidentiality agreement.
Outsourced vendors must sign a confidentiality agreement to ensure that those using the information services provided by our company or performing related information tasks have the responsibility and obligation to protect the company’s information assets obtained or used, preventing unauthorized access, alteration, destruction, or improper disclosure.
Critical information systems or equipment have established appropriate backup, redundancy, or monitoring mechanisms, and regular drills are conducted to maintain their availability.
All personal computers are equipped with antivirus software, and the virus definitions are regularly updated. The use of unauthorized software is strictly prohibited.
Employees are required to properly manage and use their accounts, passwords, and permissions, and to change their passwords regularly.
We have established standard procedures for responding to and reporting information security incidents. The Information Security Emergency Response Team is responsible for handling information security incidents to ensure timely action and prevent the escalation of damage.
A business continuity management mechanism has been established, with regular testing and drills conducted to maintain its applicability.
Internal audits are conducted regularly every year to ensure the effectiveness of the information security and personal data protection management systems.