一、目的（政策） 1. Purpose (Policy)

漢晶股份有限公司（以下簡稱本公司）為確保資訊資料、系統、設備及網路通訊安全， 降低因人為疏失、蓄意攻擊或天然災害所造成之資訊資產外洩、竄改、毀損與不當使用之風險， 並建立完善的資訊安全管理系統，特訂定本資訊安全政策，以確保資訊之 機密性（Confidentiality）、完整性（Integrity）、可用性（Availability）。 本政策適用於本公司全體員工（含工讀生、契約人員及委外維運廠商）。 To ensure the security of information, systems, equipment, and network communications, Hanjentek Co., Ltd. (hereinafter “the Company”) establishes this Information Security Policy to reduce the risks of data leakage, tampering, damage, or misuse caused by human error, intentional attacks, or natural disasters. The policy aims to safeguard Confidentiality, Integrity, and Availability of information. This policy applies to all employees, interns, contractors, and outsourced personnel.

二、依據 2. References

• ISO/IEC 27001:2022 資訊安全管理系統標準 ISO/IEC 27001:2022 Information Security Management Systems - Requirements
• 個人資料保護法及其施行細則 Taiwan Personal Data Protection Act and its Enforcement Rules

三、內容（目標） 3. Objectives

• 成立資訊安全推行小組，負責規劃與推動資訊安全。 Establish an Information Security Committee responsible for planning and executing ISMS activities.
• 建立人員任免及權限控管制度，並定期辦理資訊安全教育訓練。 Implement personnel authorization controls and conduct regular information security training.
• 提升網路防護能力，防範外部入侵與惡意攻擊。 Strengthen network defense to prevent intrusions and malicious attacks.
• 依資訊資產重要性分級，進行權限設定與存取控管。 Assign access rights based on asset classification and sensitivity.
• 建立資安事件通報、緊急應變與營運持續計畫並定期演練。 Establish incident response procedures and business continuity plans with regular drills.
• 定期與不定期執行資訊安全稽核，並禁止刪除或修改稽核紀錄。 Conduct periodic and ad-hoc security audits; audit logs must not be modified or deleted.

四、修訂與公告 4. Revision & Publication

本政策由資訊安全推行小組每年定期檢視，並依組織架構、作業流程、法規或環境變更進行必要修訂。 經召集人核定後公告施行，修正時亦同。 This policy shall be reviewed yearly by the Information Security Committee and revised when organizational, operational, regulatory, or environmental changes occur. It becomes effective upon approval by the committee chairperson.

五、資訊安全政策之宣導與檢討 5. Policy Awareness & Review

1. 每年透過教育訓練、內部會議與公告等方式向全體人員宣導資訊安全政策。 The policy shall be communicated annually through training, meetings, and internal announcements.
2. 資安長每年於資安管理審查會議中檢討政策之適切性與有效性。 The CISO shall review the policy yearly to ensure its suitability and effectiveness.
3. 全體人員皆有維護資訊安全之責任，並應遵循相關管理規範。 All personnel share responsibility for maintaining information security and must comply with all related regulations.