Cyber Security Management
1.  Cyber security risk management framework
    According to the evaluation conducted by the Company’s responsible department, the cyber security risk is not a major operational risk to the Company’s operations. However, given the fact that the network environment is getting increasingly complicated over time, and thereby increase the cyber security risk, the Company has established cyber security management structure, and authorized the responsible department to formulate and implement the cyber security management plan. With the assistance of audit department, the responsible department is responsible for monitoring operations such as internal audit of management systems, cyber security prevention, and crisis management, as well as continuously improves internal abnormality detection and prevention measures to reduce the Company’s risk.

2. Cyber security policies
   (1) Regularly promote cyber security-related case studies, to enhance employees’ awareness of cyber security.
   (2) Regularly overhaul important equipment and perform disaster recovery drills to ensure the continuous operation of the Company’s business.
   (3) Regularly review the system log records, evaluate the potential security risks of related equipment, and performs rectification and improvement plans.

3. Concrete cyber security management programs, and investments in resources for cyber security management
   Considering the cyber security insurance is relatively new type of insurance, there is no such insurance currently suitable for the Company, therefore, the Company’s existing cyber security procedures is adopted for cyber security risk management.
Concrete measures taken are as follows:
   (1) Network security management: Configures dedicated enterprise-grade firewalls and related equipment to block illegal and malicious connections.
   (2) System access control: The use of any applications in the Company’s internal system, are required to go through an internal approval process, and access permission will only be granted with the consent of supervisors and will be subsequently configured by the Information Management Unit according to the functions specified in the approved request. All accounts passwords must meet a certain rule strength to be approved.
   (3) Implement cyber security training: All new recruits are provided with cybersecurity policy training and case study sharing during their orientation, followed by ongoing, periodic promotion of information security cases and related updates as part of daily practice after onboarding.
   (4) Virus protection and management: All servers and computers system are constantly updated, and have antivirus installed with auto-update adopted, to ensure that the system is free from malicious software
   (5) System availability: Establish reliable backup process and regularly perform backup procedures for relevant data.

(6) Security management for computer equipment: All mainframes, servers and hosting equipment are set up in equipment room, and access control is implemented. The equipment room is equipped with an independent air-conditioning system and an uninterruptible power supply system, to ensure stable operation of computing equipment.

Resources allocated for cyber security management:

1. Dedicated personnel: One staff member.
2. Customer satisfaction: In 2025, the Company recorded no major cyber security incidents and no complaints regarding customer data loss.
3. Education and training:  In 2025, cyber security training sessions were conducted for four employees, totaling ten training hours.