Information Security Policy

To protect the business information of ESON and effectively reduce the risks of information assets being stolen, misused, leaked, tampered with, or damaged caused by human error, intentional acts, or natural disasters, we are committed to information security management. This ensures the confidentiality, integrity, and availability of critical information assets, guarantees the continuous operation of essential business operations, complies with relevant laws and regulations, and secures customer trust and uphold its commitments to shareholders.

Information Security Management Mechanism

1. Our company has a dedicated cybersecurity supervisor and employees.

2. Identify the relevant stakeholders of the information security management system and regularly confirm their needs for the information security management system (including customer requirements for information security).

3. Conduct information security education and training for emplyees, and periodically disseminate information security knowledge through email and other means to enhance the security awareness of all emplyees.

4. Develop a complete, standardized, and clear workflow to institutionalize the operation of information security management.

5. Through the use of various tools and technologies, timely and effective identification, protection, detection, response, and recovery can be achieved.

6. Establish a process for responding to and recovering from abnormal incidents, in order to quickly isolate and eliminate threats to information security incidents, and reduce the scope and degree of impact.

7. Regularly conduct disaster recovery drills for critical application systems to ensure their effectiveness.

8. Regularly conduct internal and external audits every year to inspect the entire management system, ensure normal operation, and continuously improve.

9. Continuously monitor new security information and technologies, keep up with the times in defense or management methods, effectively block new forms of security threats, and reduce operational risks.

Information Security Incident Notification

If there is a major information service abnormality or information security incident in our company, we will promptly handle the incident notification to facilitate the competent authorities and relevant units to effectively grasp the incident information.

Status of safety incidents in the past three years

Our company has not experienced any major information security incidents in the past three years.