ESG

Company Practice

Home 9 uPI SEMI 9 ESG 9 Company Practice 9 Information Security Management Plan

Information Security Management Plan

Cyber Security Management

Strengthen the company’s information security management, establish the concept of “information development is based on security, continuous operation and protection of business secrets”, ensure the confidentiality, integrity and availability of customer and company data processing, and ensure that the company’s data processing security is guaranteed throughout the entire process, providing safe, stable and efficient information services that continue to operate.

The procedures apply to the safety management of all the employees of the company, the hired personnel, the special manufacturers, the third-party personnel and all related information assets.

 

The operation content include：

1.Information Assets Security Management. 2.Network security Management.
3. Information Hard Equipment Management. 4. Software Management and Maintenance.
5. Personnel safety management and education training. 6. Security management of network, email and social media users.
7.Security management of information outsourcing service. 8.Physical and environmental safety management.
9. Business Continuity Operation Plan Management. 10.Confidentiality and audit of information data.
11.Destruction of information data. 12.Information security incidents and confidential leaks handling.

The Cyber security management framework：

  • The responsible unit of uPI’s cyber security is Information Tech Dept. The department has a dedicated information security supervisor and a professional information officer who are responsible for establishing the internal information security management procedures, planning and implementing the information security protection, ensuring the policy has been implemented, and reporting the implementation status regarding the information security to the Board of Directors each year, the latest report date was December 23, 2025.
  • The supervisory unit of uPI’s cyber security is the Audit office. The department has an audit supervisor and a full-time auditor who are responsible for periodically or irregularly auditing the information safety and risk control of each department and submitting audit findings to the relevant department heads and management to be aware of the audit report. If a deficiency is discovered, the audited unit must propose an improvement plan and specific measures. They will be regularly traced the effectiveness of the improvement to reduce internal cyber security risks.
  • The organization’s operational model adopts periodic auditing and cyclical management to ensure the achievement of goals and continuous improvement.

 

Specific management measures for cyber security include：

  • All information systems set passwords and set access rights, and install security detection and prevention procedures to detect and prevent the harm of computer malware or behavior and ensure the normal operation of the system.
  • Employees are strictly prohibited from using illegal software or unauthorized information software, and the relevant software installation shall be assisted by the Information Tech Dep. after obtaining consent of the supervisor of the verification authority.
  • Employees, manufacturing partners, and subcontractors should sign relevant confidential documents to ensure that those who use the Company’s information to provide information services or perform related information businesses have the responsibility and obligation to protect the information assets they obtain or use from the Company, so as to protect against unauthorized access, tampering, destruction, or improper disclosure.
  • Important information systems or equipment should have appropriate redundancy (backup) or monitoring mechanisms in place and regular drills should be performed to maintain their availability.
  • Employee accounts, passwords, and permissions should be kept and used responsibly, and they need to be replaced regularly by regulation.
  • Establish a regular inventory of information assets, conduct risk management in accordance with information security risk evaluations, and implement various control measures.
  • Formulate response methods for information security incidents to properly deal with information security incidents in real time and avoid further damage.
  • Intermittently publicize information security issues and recent information security incidents to all employees of the Company through internal emails.
  • New employees must complete an Introductory Course on Information Systems and Information Security and post-course testing to ensure they understand the Company’s information security policies.
  • Every quarter, the Information Tech Dep. conducts computer checks on new and current colleagues who have completed three months of employment to ensure that there is no improper downloading or use of files or trade secrets owned by previous employers or competitors.

Implementation status in 2023and expected project:

System Implementation and System Security
  • In January 2024, we successfully passed the ISO 27001 external verification by SGS and received the certification, marking the Company's commitment and efforts in information security management. The certificate is valid from 17 March 2024 until 17 March 2027.
  • The company achieved a 96 SecurityScorecard rating and maintained grade A, demonstrating strong cybersecurity and ongoing investment in risk management.
  • Completed the headquarters’ external firewall replacement and added the Advanced Threat module to strengthen threat detection, application-layer protection, and overall system stability.
  • In 2025, 3 external privileged account probing attempts were detected, with zero cybersecurity incidents occurring due to privileged account probing.
  • In 2025, antivirus detected 985 viruses and EDR identified 163 high-risk events, with zero security incidents resulting from endpoint infections.
  • The company has recorded zero service interruptions caused by hacker or malware intrusions affecting information systems and equipment.
Security management of email
  • Completed the update of the headquarters spam protection system (SPAM) and enhanced the existing ADM advanced defense mechanisms to improve the interception of malicious and phishing emails. Following the update, overall filtering accuracy and threat detection capabilities have been significantly improved, effectively reducing email-related security risks.
  • No significant incidents of company confidential information being leaked through outbound emails have been identified.
  • The email threat protection system identified 1,900 threat emails and 173 virus-infected emails, with zero cybersecurity incidents caused by threat emails.
  • The ADM email protection system has identified 295 phishing emails, and the company has recorded zero security incidents caused by business email fraud.
Disaster recovery and emergency procedures
  • The company’s external firewall system restoration drill was completed within 8 hours, successfully verifying that the disaster recovery (DR) procedures can be activated and services restored within an acceptable timeframe. This exercise effectively enhances the organization’s network security protection and strengthens business continuity capabilities.
  • The IT department successfully completed the AD server recovery drill within 8 hours, effectively ensuring business continuity and strengthening disaster response capabilities.
  • The IT Department successfully completed the TipTop (ERP) system restoration drill within the required timeframe (8 hours), enhancing system stability and reducing potential business interruption risks.
Information security protection and intelligence exchanged
  • A total of four cybersecurity awareness sessions were held, covering topics such as cybersecurity policies, regulations, awareness, and phishing prevention.
  • Conducted 10 sessions of new employee cybersecurity training and performed quarterly computer security audits.
  • Three ASUS Group cybersecurity seminars were attended.
  • Regularly received critical cybersecurity intelligence from TWCERT/CC.

Expected project

  • ISO 27001 Certificate Renewal and Recertification Audit
  • Continuously strengthen the security of the company’s information systems
  • Promote information security case studies and communicate cybersecurity policies
  • The SecurityScorecard security assessment rating remains at grade A.
  • Backup storage server (replacement and renewal)
  • Replacement and renewal of the headquarters server network switches
  • Hardware replacement and renewal of the Mail Log server