1. Policy Purpose

Toplogis Network Communications Co., Ltd. (hereinafter referred to as "the Company") establishes this Information Security Policy to ensure the secure and reliable operation of its business activities.

The Company implements an Information Security Management System (ISMS) to establish a secure and trustworthy information operating environment and to prevent information or information and communication systems from unauthorized access, use, control, disclosure, damage, alteration, destruction, or other forms of compromise.

This policy aims to ensure the Confidentiality, Integrity, and Availability (CIA) of information, as well as compliance with applicable legal and regulatory requirements, thereby safeguarding information assets, improving service quality, and supporting the Company's sustainable business operations.

2. Scope

This policy applies to all employees, partners, suppliers, contractors, and related parties who access, process, manage, or utilize the Company's information assets or information systems. All such parties are responsible for complying with the requirements of this policy.

3. Information Security Statement

"Visible but not obtainable; obtainable but not visible - For your eyes only."

4. Information Security Policy and Objectives

4.1 Compliance with International Standards

The Company shall implement and maintain information security management practices in accordance with the requirements of ISO/IEC 27001 Information Security Management System (ISMS).

4.2 Information Security Governance

The Company shall establish an Information Security Management Organization responsible for planning, implementing, operating, monitoring, reviewing, maintaining, and improving the information security management system.

4.3 Personnel Security and Legal Compliance

All employees must sign the Company's Employment and Confidentiality Agreement. External parties participating in Company projects must comply with the confidentiality provisions specified in such agreements.

All personnel shall comply with relevant national laws and regulations, including but not limited to:

• Government Procurement Act
• National Security Protection Act
• Trade Secrets Act
• Personal Data Protection Act
• Copyright Act
• Criminal Code
• Information Security Management Act
• Cyber Security Management Act and its Enforcement Rules and related regulations

No incidents involving information leakage or violations of applicable laws and regulations shall occur.

4.4 Access Control and Data Protection

Access to and modification of outsourced, collaborative, or project-related data shall be strictly controlled through appropriate access permissions. Sensitive or confidential information must be encrypted prior to transmission to ensure adequate protection during data transfer.

4.5 Personal Data Protection

The collection, processing, and use of personal data shall respect the rights and interests of data subjects and shall be conducted in a lawful, fair, and good-faith manner. Such activities shall not exceed the scope necessary for the specified purpose and must maintain a legitimate and reasonable relationship with the purpose of collection.

4.6 Intellectual Property Protection

The Company respects intellectual property rights. The installation or use of unauthorized or unlicensed software is strictly prohibited.

4.7 Information Security Awareness and Training

The Company shall regularly conduct information security education and training to enhance employees' awareness and understanding of the Information Security Policy and related implementation requirements.

5. Information Security Objectives and Measurement

5.1 Confidentiality Objective

Objective: Prevent unauthorized disclosure of information.

Measurement Indicator: The number of confirmed incidents involving the leakage of customer information or controlled documents shall be zero per year.

5.2 Integrity Objective

Objective: Ensure the accuracy and completeness of information.

Measurement Indicator: The number of reported incidents involving unauthorized data alteration shall be zero per year.

5.3 Availability Objective

Objective: Ensure the reliability and continuous availability of information services.

Measurement Indicator: The annual system availability of information service systems shall exceed 99.9%.

5.4 Legal Compliance Objectives

1. Annual audits of the Information Security Management System shall ensure zero violations of applicable national laws and regulations, including the National Security Protection Act, Trade Secrets Act, Personal Data Protection Act, Copyright Act, Criminal Code, and Government Procurement Act.
2. Annual ISMS audits shall ensure that violations of the Cyber Security Management Act do not exceed two incidents (inclusive) per year.

5.5 Security Awareness Training Objectives

To address evolving cybersecurity threats, the Company shall conduct information security training to strengthen employees' awareness of cybersecurity risks.

• All newly hired employees must receive information security training.
• All employees must participate in at least one information security training session per year.

6. Policy Review

6.1 Periodic Review

This Information Security Policy and its associated objectives shall be reviewed and evaluated at least once annually to ensure compliance with relevant regulations and alignment with the latest developments in information technology and cybersecurity threats.

6.2 Approval and Communication

This policy and its objectives shall be approved by the Chief Information Security Officer (CISO) and shall take effect on the date of official announcement.

The policy shall be communicated to all employees, partners, suppliers, and relevant stakeholders through written documentation, electronic communication, training sessions, internal meetings, or other appropriate methods. The same procedure shall apply to any future revisions.