• Information Security Policy

TongHsing Electronics Industry Co., Ltd.
Information Security Policy

  1. Objective

    1. TongHsing Electronic Industry Co., Ltd. (hereinafter referred to as the Company) hereby formulates this policy in order to ensure the confidentiality, integrity and availability of its information assets, to comply with the requirements of relevant laws and regulations such as information security management, and to protect it from internal and external deliberate or accidental threats.

  2. Scope of application

    1. This policy applies to all employees, outsourced service providers, data users (including custodians) and visitors of TongHsing Electronic Industry Co., Ltd.
    2. In order to avoid the occurrence of improper use, leakage, tampering and destruction of information due to human negligence, deliberate or natural disasters, and to avoid the possible risks of various information security hazards to the Company.

  3. Target

    In order to maintain the confidentiality, integrity and availability of the Company's information assets, the following objectives are expected to be achieved through the implementation of this Policy:
    1. Establish a safe and reliable information operating environment to ensure the security of the Company's data, systems, equipment and networks, so as to ensure the continuous operation of the Company's business.
    2. To protect the security of the Company's business services and to ensure that information is only accessible by authorized personnel to ensure its confidentiality.
    3. To protect the security of the Company's business services from unauthorized modification and to ensure their correctness and integrity.
    4. Establish the Company's business continuity operation plan to ensure the continuous operation of the Company's information business services.
    5. In order to protect the security of the company's business and service-related information, from external threats, or improper management and use by internal personnel, it will be stolen, tampered with, damaged, lost, or leaked.
    6. Ensure that the implementation of the Company's various operational services must comply with the requirements of relevant government laws and regulations (such as Criminal Law, State Secrets Protection Law, Patent Law, Trademark Law, Copyright Law, Personal Data Protection Law, Information Security Guidelines for Listed Companies, etc.).

  4. Liability

    1. The Company shall establish an "Information and Communications Security Management Committee" to coordinate the promotion of information and communication security matters.
    2. Management should support the ICT security management system and provide relevant resources to ensure the implementation of the ICT security policy.
    3. All employees of the Company, outsourced service providers, data users (including custodians) and visitors shall comply with this policy.
    4. All employees of the Company, outsourced service providers and data users (including custodians) are responsible for reporting information security incidents or vulnerabilities through appropriate reporting mechanisms.
    5. Any act that endangers the security of information communication will be investigated for civil and criminal liability depending on the severity of the circumstances, or will be dealt with in accordance with the relevant regulations of the company.

  5. Manage metrics

    1. In order to measure the achievement of ICT security management objectives, the Company shall set relevant management indicators and monitor, evaluate, and improve them on a regular basis.
    2. The Company's information security organization and personnel shall be reviewed regularly to ensure the progress of information security work.
    3. Employees should be provided with appropriate information security-related training in accordance with their duties and responsibilities in accordance with the requirements of the competent authority.
    4. The environmental security of the Company's information assets shall be strengthened, and appropriate protection and authority control mechanisms shall be adopted.
    5. We shall ensure that the information is not disclosed to unauthorized third parties.
    6. Access control shall be strengthened to prevent unauthorized and improper access to ensure that the Company's information assets are properly protected.
    7. The development of the company's information and communication system should meet the security requirements, and carry out technical testing and repair on a regular basis.
    8. It shall ensure that all information security incidents or suspected security vulnerabilities are responded to in accordance with the appropriate reporting mechanism, and are appropriately investigated and handled.

  6. Management Review

    1. This policy shall be reviewed at least once a year to reflect government laws and regulations, information security standards, technology, requirements of competent authorities and the actual needs of the operation of the company's management system, so as to ensure the sustainable operation of the company's business.

  7. Implement

    1. This policy shall be reviewed by the "Information and Communications Security Management Committee" of the Company and approved by the General Manager for implementation, and shall be the same when revised.