Security Policy

Our company is committed to maintaining the security of its operational environment and serving its clients with the utmost dedication. Beyond implementing essential information security controls, we aim to ensure the security of all data and processing activities. We continuously strengthen information security management to enhance the confidentiality, integrity, and availability of critical personal and transactional information, thereby improving the quality of our services. The following outlines our information security declaration:

​

1. Organizational Commitment
   An appropriate organization is established to implement information security management, ensuring compliance with applicable laws and regulations and maintaining the regular operation of the information security management system.

2. Work Assignment and Segregation of duties
   Job assignments should consider the division of responsibilities, and
   duties must be clearly defined to prevent unauthorized modification or
   misuse of information or services.

3. Employee Responsibilities
   All personnel utilizing company information to provide services or execute project work are responsible for protecting the company’s information assets. This includes preventing unauthorized access, modification, destruction, or inappropriate disclosure.

4. Customer Data Protection
   All personnel are obligated to protect customer information, including transactional and basic data. Unauthorized access, use, or disclosure to unrelated colleagues, vendors, or other customers is strictly prohibited.

5. Physical Security
   Strengthen the physical security of IT environments, such as data center
   access control, air conditioning, to prevent unauthorized access,
   damage, or accidental disasters that could disrupt operations.

6. Network Security
   Employees are prohibited from connecting external networks to the internal network without authorization. Necessary security measures must be in place to safeguard internal and external network communications.

7. System Development Security
   Security mechanisms should be considered during the initial phases of system development. For outsourced development, security controls and contractual requirements must be strengthened. System development, modification, and deployment must comply with and adhere to information security management standards.

8. Information Security Event Reporting
   All personnel must remain vigilant to potential security events,
   vulnerabilities, and violations of the information security management
   system or procedures and report them promptly in accordance with
   established protocols.

9. Business Continuity Planning
   A business continuity plan must be established based on operational needs, tested regularly, and maintained to ensure its applicability.

10. Information Security Objectives
    Information security objectives are developed based on the security policy and organizational responsibilities, reviewed by the Information Security Committee, and implemented accordingly.

11. These objectives must address confidentiality, integrity, and availability, aligning with the requirements of the security policy.

12. Policy Review
    This policy is reviewed at least annually by the highest-ranking officer of the company’s information security organization to ensure alignment with the latest laws, technology, and business developments, maintaining the effectiveness of information security practices.

13. Compliance
    Matters not covered by this policy are governed by applicable laws and company regulations.

14. Approval and Amendments
    This policy is implemented with the approval of the Chief Information Security Officer (CISO). Amendments follow the same approval process.