Information Security Policy

ADAT Technology is committed to ensuring information security and proprietary information protection, which are our promises to customers, shareholders, and partners. To strengthen information security defense and management mechanisms, we have established a dedicated information security organization in accordance with the ISO/IEC 27001 standards. We allocate professional personnel and resources and clearly define information security policies, management procedures, and regulations.

We adopt the PDCA (Plan-Do-Check-Act) cycle process as set by international standards organizations to continuously monitor and review the management of information security. By integrating and enhancing our information security management system, we lay the foundation for ADAT Technology's market competitiveness and safeguard the interests of our customers, partners, and all stakeholders.

Information Security Committee

ADAT has established the Information Security Committee, chaired by the General Manager as the Chief Information Security Officer. All department heads of the company serve as committee members. Regular information security meetings are held to formulate important information security policies, risk assessments, and enhancement plans, ensuring the achievement of ADAT's information security policy objectives.

Key Focuses of Information Security Management

To ensure information security and the protection of proprietary information, we have established comprehensive information security policies and implemented advanced security measures in company infrastructure. Simultaneously, we actively enhance employees' information security awareness to strengthen overall security protection. Regarding our products, we follow the SSDLC (Secure Software Development Life Cycle) process, continuously reinforcing relevant security measures to eliminate potential software security risks, thereby ensuring that our customers are not subject to financial losses due to security issues.

We regularly review security performance indicators, enhance system monitoring and risk assessment, and engage external experts to conduct security evaluations to ensure our security management and execution reach the highest standards.Every year, ADAT’s key focuses of information security implementation are as follows:

• System development and maintenance management
• Cyber and communication security management
• Inventory management and information protection
• Information access control
• Information equipment security management
• Personnel and physical security
• Information security (incident) handling and management
• Supply chain security
• People management, education and promotion
• Internal/external information security assessment and risk management

Information Security Incidents and Reporting Procedure

ADAT has established an enterprise risk management mechanism and standard procedures for handling information security incidents, clearly defining the related processes and measures. In the event of an information security incident, to ensure that the company's critical operations and business processes are not significantly affected by major information security incidents or disasters, and to mitigate the impact and damage caused by such events, dedicated personnel will swiftly report and complete emergency response actions, and restore operations as quickly as possible. Additionally, we conduct detailed incident investigations and analyses to identify root causes and take appropriate corrective measures to prevent the recurrence of similar incidents.