Close
Cart is empty
Information Security Management
To establish a robust information security management system and ensure the confidentiality, integrity, and availability of the Group’s information assets, ABC-ATEC formally established an Information Security Office in 2022. This initiative also aligns with the Financial Supervisory Commission (FSC)’s policy to strengthen information and communication security management for listed companies. In compliance with the Taiwan Stock Exchange (TWSE)’s requirements, ABC-ATEC has allocated adequate human resources and equipment to plan, monitor, and implement information security management operations, continuously enhancing the Company’s cyber resilience.
I. Information and Communication Security Risk Management Framework
A cross-functional risk assessment team has been established, with members comprising the IT Department (including system management, network management, and information security personnel), business departments, management, and external resources. For each system, the respective system head performs an information security risk assessment and convenes information security risk assessment meetings.
II. Information Security Management Policy
The Company’s information security policy was approved by the Board of Directors, ensuring that the Group’s information systems remain secure and resilient, and that potential cybersecurity incidents are effectively prevented. The policy upholds the confidentiality, integrity, and availability of information assets, while promoting proper cybersecurity awareness among employees to safeguard the Group’s sustainable operations. The Company will continue to strengthen relevant policies and measures in accordance with this policy
I. Information and Communication Security Risk Management Framework
A cross-functional risk assessment team has been established, with members comprising the IT Department (including system management, network management, and information security personnel), business departments, management, and external resources. For each system, the respective system head performs an information security risk assessment and convenes information security risk assessment meetings.
II. Information Security Management Policy
The Company’s information security policy was approved by the Board of Directors, ensuring that the Group’s information systems remain secure and resilient, and that potential cybersecurity incidents are effectively prevented. The policy upholds the confidentiality, integrity, and availability of information assets, while promoting proper cybersecurity awareness among employees to safeguard the Group’s sustainable operations. The Company will continue to strengthen relevant policies and measures in accordance with this policy
.jpeg "Information Security")
III. Specific Management Programs
1. Information Security Awareness Promotion:
To enhance employees’ awareness and understanding of cybersecurity, the Company launched an information security awareness campaign starting from its Taiwan site. Each employee attended a 1.5 hour training session, with a total of 866 participants completing the course and test, of which 799 passed, achieving a 92.26% pass rate and a total of 1,299 training hours.
2. Offsite Backup
The Company performs daily tape and offsite data backups and is gradually establishing a more comprehensive offsite (e.g., cloud-based) backup system to ensure the secure preservation of critical information. To maintain the security of information systems, equipment, networks, and data, the Company conducts annual systematic disaster recovery drills. In 2025, disaster recovery drills were conducted on a total of 40 servers.
1. Information Security Awareness Promotion:
To enhance employees’ awareness and understanding of cybersecurity, the Company launched an information security awareness campaign starting from its Taiwan site. Each employee attended a 1.5 hour training session, with a total of 866 participants completing the course and test, of which 799 passed, achieving a 92.26% pass rate and a total of 1,299 training hours.
2. Offsite Backup
The Company performs daily tape and offsite data backups and is gradually establishing a more comprehensive offsite (e.g., cloud-based) backup system to ensure the secure preservation of critical information. To maintain the security of information systems, equipment, networks, and data, the Company conducts annual systematic disaster recovery drills. In 2025, disaster recovery drills were conducted on a total of 40 servers.
3. Phishing and Social Engineering Emails
A total of two simulation exercises were conducted in 2025, including the following scenarios:
A total of two simulation exercises were conducted in 2025, including the following scenarios:
- May 29: “Important Tax Notice: Your tax refund eligibility has been updated.”
- November 24: “General Cash Distribution of NT$10,000.”
A total of 8 employees clicked on phishing emails. These employees were required to retake the information security awareness training and pass the related test. The exercises effectively enhanced cybersecurity awareness and strengthened vigilance against online security risks.
4. Information Security Awareness Campaigns in 2025
4. Information Security Awareness Campaigns in 2025
- 3/7: “Frequent ransomware attacks: Enterprises and individuals should strengthen cybersecurity; MOHW releases investigation results on the Changhua Christian Hospital incident, identifying the ‘Crazy Hunter’ ransomware attack.”
- 5/29: “Change your passwords immediately! Severe hacker attack results in the leak of 184 million Apple and Google accounts.”
- 6/30: “Impersonators committing fraud to obtain personal data; SEF urges all sectors to remain vigilant.”
- 7/29: “2025 Social Engineering Trends: Significant increase in vishing and AI-impersonation attacks.”
- 8/28: “Is your computer slowing down? Hackers stealing bandwidth via fake YouTube download websites.”
- 10/2: “The President announces amendments to the Cyber Security Management Act.”
5. Resources Invested in Information and Communication Security Management
ABC-ATEC has established an Information Security Committee to confirm the committee’s organizational structure, approve information security policies, and review the Group’s overall cybersecurity plan. Moving forward, the Committee will convene at least once annually to ensure effective management implementation. In 2025, a total of four meetings were held: March 24, June 23, September 23, and December 3.
ABC-ATEC has established an Information Security Committee to confirm the committee’s organizational structure, approve information security policies, and review the Group’s overall cybersecurity plan. Moving forward, the Committee will convene at least once annually to ensure effective management implementation. In 2025, a total of four meetings were held: March 24, June 23, September 23, and December 3.
Customer Privacy Management
To ensure the security and proper management of customer data, ABC ATEC has established a set of data protection principles. First, customers are clearly informed about the collection, use, and protection of their personal data to ensure transparency. Data collection follows the principle of minimization—limited only to what is necessary—and is aligned with specific purposes. De-identification measures are also implemented to reduce privacy risks.
In terms of usage, the company strictly limits the scope of application of customer data, ensuring it is used only for its original intended purposes and preventing misuse. For sensitive data, encryption measures are applied during transmission, such as through email, to ensure information security is not compromised.
Internally, access control is rigorously enforced—only authorized employees may access sensitive information. Department supervisors periodically review folder access permissions to ensure they remain appropriate. Through these measures, the company actively safeguards the security of customer data and ensures that personal information protection meets the highest standards.
Personal Data Protection
1. Personal Data Protection Policy
The "Personal Data Protection Management Regulations of Group Information Security" was issued on April 1, 2025.
2. Implementation Status
The "Personal Data Protection Management Regulations of Group Information Security" was issued on April 1, 2025.
2. Implementation Status
- Computer hostnames are de-identified and IP addresses are dynamically assigned, preventing any direct querying of personal data.
- AD (Active Directory) accounts are de-identified to mitigate the risk of personal data being accessed through queries.
- Sales personnel use encrypted USB flash drives for storing personal data, ensuring it is kept within encrypted partitions.
- Hard drives on personal computers are encrypted (e.g., BitLocker).
- Cloud storage utilizes multi-factor authentication (MFA), and the storage of sensitive personal data on cloud platforms is avoided.
- Files containing sensitive personal data are encrypted using compression software (e.g., 7-Zip).