To strengthen the information security management of our company and ensure the security of data, systems, and networks, Tairoun Products has formulated an Information Security Protection Plan in accordance with the 'Information Security Control Guidelines for Listed and Over-the-Counter Companies.' The Information Planning Division of our company is responsible for the relevant information security tasks, and in the year 112, one Information Security Manager and one dedicated Information Security personnel were appointed based on the Level 2 Information Security Notification.

The internal management structure is as shown in the diagram : 

Tairoun Products Co., Ltd. Information Security Management Policy

1. Purpose

The purpose of formulating the Information Security Policy of Tai Rong Industrial Co., Ltd. (hereinafter referred to as "the Company") is to enhance the security and stability of information and communication operations, provide reliable information and communication services, ensure the confidentiality, integrity, and availability of information assets, and promote various business activities of Tai Rong smoothly. This policy is established as the highest guiding principle for information security management at Tai Rong in accordance with the regulations of the Information Security Management Act and its subsidiary laws.

2. Scope

This policy applies to the Company employees, vendors and third-party personnel who have access to business information or provide services to Tai Rong.

3. Objectives

- Ensure the confidentiality of business-related information, safeguarding company secrets and personal data.

- Ensure the integrity and availability of business-related information, enhancing operational efficiency and quality.

- Align with national and policy-driven initiatives to enhance information security capabilities.

- Comply with national laws and regulations as well as the company's standards to achieve the goal of continuous business operations.

4. Strategies

- Consider relevant legal regulations and operational requirements, assess the security needs of information and communication operations, establish related procedures to ensure the confidentiality, integrity, and availability of information assets.

- Establish the company's information security organization and define roles and responsibilities to facilitate the implementation of information security operations.

- Implement various mandatory tasks according to the classification of information security responsibilities.

- Establish an information security incident reporting and response mechanism to ensure proper response, control, and handling of security incidents.

- Conduct regular information security audits to ensure the effective implementation of information security management.

5. Review

This policy is approved by the General Manager and is reviewed at least annually, or when there are significant organizational changes (such as organizational restructuring, significant business changes, etc.). It is subject to appropriate revisions based on the evaluation results, relevant laws and regulations, technological advancements, and the latest developments in business. Any revisions must also be approved by the General Manager.

Tairoun Products Co., Ltd. has established the "Information Security Maintenance Plan" in accordance with Article 10 of the Information Security Management Act and Article 66 of the Enforcement Rules. The plan applies company-wide, and each year, various information security tasks are executed in accordance with the plan. These tasks include firewall maintenance, employee internet access control mechanisms, antivirus operations, system updates, data backups, information security education and training, social engineering drills, and other related activities. The execution status is regularly reported to the Board of Directors, and the information security protection plan is reviewed and amended annually based on the execution status. This ensures that the hardware, software, and personnel mindset related to various information security aspects of the company are maintained in optimal conditions.

In addition, the Information Security Plan also outlines emergency notification procedures. In the event of an information security incident, the IT security personnel report to their supervisors and, in compliance with regulations, report to relevant authorities. The company has also applied for membership in the "Taiwan Information Security Alliance." Through the assistance of the alliance, the company collaborates to uphold information security collectively.

In the year 2023:

1.Completed off-site and cloud backup operations for company data.

2.Set up the company's cloud drive to ensure complete backup of all data.

3.Completed the replacement and upgrade of all company computers.

Work Plan for the year 2024:

1.Update of the company’s firewall equipment and software.

2.Information security awareness training for employees.

3.Ongoing upgrades of the company’s personal computer equipment.

4.Replanning of the company’s IT/server room.

5.Review of the company’s network equipment and network architecture.

6.Social engineering drill.

7.Obtained ISO 27001 certification.