Information Security

Responsible Units (Governance)

Information Security and Personal Data Protection Promotion Team
Information Security and Personal Data Protection Execution & Emergency Response Sub-team
Information Security and Personal Data Protection Audit Sub-team

Policy Commitments (Strategy)

Short-Term Strategy (1–2 Years)

Implement Multi-Factor Authentication (MFA) and behavioral identification to reduce static password risks.
Implement or optimize Endpoint Detection and Response (EDR) to strengthen monitoring of remote and mobile devices.
Establish automated vulnerability scanning and patching mechanisms to shorten vulnerability exposure windows.

Medium-to-Long-Term Strategy (3–5 Years)

Implement micro-segmentation to strengthen internal network isolation and lateral movement defenses.
Establish a supplier information security management system to review third-party software and services while continuously monitoring risks

Negative Impact (Risk)

Facing new types of attack threats, variations in supplier information security maturity, and delays in system vulnerability patching can easily create protection gaps, increasing data leak and operational risks.

Positive Impact (Opportunity)

Implementing AI monitoring, Zero Trust architecture, and complying with international information security standards to comprehensively enhance defense efficiency, customer trust, and market competitiveness.

Metrics and Targets

Metrics	2025 Actual	2025 Target	Target Met	2026 Target	2030 Target	2040 Target
Number of Information Security Incidents	0	0	V	0	0	0
Information Security Training Courses	1	1	V	1	1	1
Social Engineering Drills	2	2	V	2	2	2
ISO 27001 Certification	Implementation Phase			Certification Obtained	Certification Maintained	Certification Maintained
Server Vulnerability Scanning				Biannually	Biannually	Biannually
SIEM Platform Evaluation				Implementation Evaluation	Implementation Evaluation	Full Implementation

Network Security: Deploy firewalls and SD-WAN architecture (including encryption and dual-backup); mandate VPN for remote access with logs retained; enforce internet behavior controls.

Endpoint & Email Defense: Deploy endpoint protection with automatic updates on servers and endpoint devices; fully implement antivirus and filtering mechanisms in the email system.

Access Control: Implement tiered account authorization, password complexity management, and immediate account deactivation upon employee departure.

Business Continuity: Daily off-site backups for critical systems, and regular disaster recovery drills.

Security Awareness: Continuously promote information security training and daily awareness campaigns.

Stakeholder Engagement

Social Engineering Drills: Conducted drills for 281 employees who can receive external emails in 2025, achieving a 100% completion rate. The phishing email click rate was only 3.56% (10 people); targeted training was conducted for affected personnel to strengthen defense capabilities.

Vulnerability Scanning & Patching: In 2025, critical system vulnerability scanning identified 5 high-risk items (all due to outdated ERP system versions). Upgrades and improvements are planned for completion before October 2026.

Audit Item	Audit Findings	Result	Corrective Actions
7.5 Documented Information	The "TQ-MQP003 Document Management Regulations" was revised, establishing notification mechanisms before effective dates and expiration. However, the definition of "Document Effective Date" remains unclear.	Non-conformity	Revised "TQ-MQP003 Document Management Regulations" to clearly define document effective date and validity period, adjusting system settings so document effective date aligns with expiration management rules.
6.8 Information Security Incident Reporting	Information security incident management procedures were established. However, regarding the company network outage on 2026/01/18, incident reporting and records were not completed per procedure.	Non-conformity	Re-promulgated and emphasized the use of "TIMMB 028 Information Security Incident Registration Form," requiring future information security incidents to be fully filled out, reported, and retained per procedures.
8.8 Technical Vulnerability Management	Vulnerability scanning was performed on key systems, but periodic tracking and patching mechanisms based on results were not established. OS versions for certain equipment (e.g., legacy AIX, Win10 and higher versions) were not included in unified vulnerability control procedures.	Non-conformity	Amended "TI-MMP012 Information Systems and Equipment Operation & Maintenance Management Procedures" to add vulnerability rating and remediation time limits, establishing reporting and patch-tracking mechanisms for high-risk (Critical/High) vulnerabilities, and incorporating all key equipment into control scope.
8.32 Change Management	System change procedures were established, but handling of emergency changes in practice (e.g., emergency handling during the office network disconnection on 2026/01/18) lacked clearly defined handling and post-registration record procedures.	Non-conformity	Amended "TI-MMP012 Information Systems and Equipment Operation & Maintenance Management Procedures" to add change applications and emergency change rules, requiring post-event registration for change applications and review records, while strengthening personnel training.

Corporate Governance