|
To ensure the stable and secure operation of our information systems, services, and network environment, the Company is committed to reducing risks arising from human error, malicious activities, natural disasters, and other potential threats. We strive to prevent unauthorized access, disclosure, alteration, destruction, or loss of information and to safeguard the Confidentiality, Integrity, and Availability (CIA) of our information assets.
Core Principles
- Compliance and Risk Management:
Identify applicable laws, regulations, and external requirements, as well as internal and external issues and the expectations of relevant interested parties. Conduct regular risk assessments and establish appropriate measures to address identified risks.
- Accountability and Security Culture:
Establish an Information Security Committee with clearly defined roles and responsibilities, enforce segregation of duties, and foster a corporate culture in which information security is everyone’s responsibility.
- Lifecycle Protection:
Maintain comprehensive inventories and classification of information assets, and strengthen the security management of hardware, facilities, environments, and information throughout their entire lifecycle.
- Access Control:
Establish robust network communication and identity authentication controls to ensure that access to sensitive information is granted in accordance with the Principle of Least Privilege.
- Supply Chain Security:
Require external service providers and contractors to comply with the Company’s information security policies and subject them to appropriate security oversight and periodic assessments.
- Incident Response and Continual Improvement:
Establish emergency response and business continuity measures and conduct regular exercises. Through internal audits, reviews, and periodic policy assessments, continuously enhance the resilience, suitability, and effectiveness of the Information Security Management System.
|
