Information Security Policy - About C.P. GROUP - CHAROEN POKPHAND ENTERPRISE (TAIWAN) CO., LTD.

Information Security Risk Management Structure and Management Plan

Collection and use of Personal Information

1	The service information provided based on personal job responsibilities will not be disclosed to other third parties at will.
2	When using our company's network system, the following information will be automatically collected: date and time, retrieved web page, URL, and access network actions. This information may be used to improve the company's network traffic performance.
3	In response to the above behaviors, Internet surfing behaviors that cause a significant load on the company's network traffic will be monitored.

Information Security Rights and Responsibilities and Education and Training

1	For those who handle confidential information and those who are required to be given system management authority due to work needs, properly divide labor, decentralize responsibilities, establish an evaluation and assessment system, and establish a mutual support system for personnel as necessary.
2	Employees who leave the company should immediately notify the computer center and cancel all permissions to use various system resources.
3	Based on roles and functions, we conduct information security education, training and publicity for employees at different levels according to actual needs to help employees understand the importance of information security and various possible security risks, improve employees' information security awareness, and encourage them to comply with information security Safety regulations.

Information Security Operations and Protection

1	Establish operating procedures for handling information security incidents and assign necessary responsibilities to relevant personnel so that information security incidents can be handled quickly and effectively.
2	Establish a change management notification mechanism for information facilities and systems to avoid system security vulnerabilities.
3	Establish system backup equipment and regularly perform necessary data and software backups so that operations can be quickly restored in the event of a disaster or storage media failure.

Network Security Management

1	For outlets connected to external networks, firewalls are set up to control data transmission and resource access between external and internal networks, and strict identity recognition operations are performed.
2	Confidential and sensitive information or documents shall not be stored in information systems open to the public, and confidential documents shall not be sent by email.
3	Regularly conduct anti-virus checks on internal network hosts and personal computers, and regularly update the virus codes of the anti-virus system and various security measures.

System Access Management

1	Develop procedures for issuing and changing passwords based on operating system and security management requirements and keep records.
2	When logging into each operating system, the information room system administrator will set the account and password granted with permissions based on the system access permissions necessary for personnel at all levels to perform tasks, and update them regularly.

資訊安全政策

decorate