Information security policy

I. Purpose

ESi Technology Ltd. (hereinafter the "Company") maintains the confidentiality, integrity and availability of its information assets, complies with the requirements of relevant laws and regulations, and safeguards users' data privacy, protecting them from intentional or accidental internal and external threats. The Company has integrated the information security objectives of its departments at every level and established the following overall information security policy objectives:

II. Scope

This policy applies to, and shall be complied with by, the Company's personnel, outsourced service providers and visitors, together with the management of the related information and communication security operating rules. Its aim is to prevent improper use, leakage, alteration, destruction or similar incidents involving data caused by human error, intentional acts, natural disasters or other factors, which could expose the Company to various risks and harm. In addition to the "Statement of Applicability", "Document Management Procedure", "Management Review Procedure", "Information Security Audit Management Procedure" and "Corrective and Preventive Action Management Procedure", information and communication security management follows the procedures below:

• Establishing and evaluating the information security policy (Information Security Policy, Information Security Objectives Management Procedure, Organizational Context Analysis Procedure).
• Information security organization (Information Security Organization Management Procedure).
• Personnel information security management and training (Human Resources Security Management Procedure).
• Classification and control of important information assets (Information Asset Management Procedure).
• Risk identification and control (Information Security Risk Management Procedure).
• Access control security (Access Control and Password Management Procedure).
• Physical and environmental security (Physical and Environmental Security Management Procedure).
• Operations security management (Operations Security Management Procedure).
• Network security management (Network Security Management Procedure).
• Security in the acquisition, development and maintenance of information systems (System Development and Maintenance Management Procedure).
• Supplier service management (Supplier Relationship Management Procedure).
• Response to and handling of information security incidents (Information Security Incident Management Procedure).
• Business continuity management (Business Continuity Management Procedure).
• Compliance with relevant laws and regulations and Company policies (Regulatory Compliance Management Procedure)