唯修科技有限公司（以下簡稱本公司）致力於確保其所管理之所有資訊資產具備機密性（Confidentiality）、完整性（Integrity）與可用性（Availability）。為遵循相關法令、法規及合約義務，本公司採行適當之資訊安全措施，以防範內部及外部之蓄意或意外威脅，確保資訊資產之安全。 為達成上述目標，特訂定並公告下列資訊安全原則與實施作法： 一、風險管理與法規遵循 本公司依據相關法令規章及營運需求，定期執行資訊安全風險評估，並依評估結果建立適當之資訊安全管理程序與控制措施，以確保資訊資產獲得妥善保護。 二、角色、責任與資安意識 本公司依人員角色與職責建立評估與考核機制，並視實際需求辦理資訊安全教育訓練與宣導活動，以提升員工對資訊安全之認知與遵循。 三、存取控制管理 資訊資產之存取權限係依業務需求核予，並遵循最小權限原則、權責區隔原則及獨立審查機制進行管理。 四、資安事件管理與營運持續 本公司已建立資訊安全事件管理程序，以確保資安事件能即時回應、有效控制與妥善處理；同時訂定營運持續計畫，並定期進行測試與演練，以維持資訊系統與服務之持續運作。 五、個人資料與智慧財產保護 本公司依據《個人資料保護法》及相關智慧財產權法令，妥善處理與保護個人資料及智慧財產，確保其合法、正當且適當之使用。 本政策將傳達予全體員工及相關利害關係人，並定期檢討與修訂，以確保其持續有效，並符合最新之法規要求與營運需求。 Information Security Policy Statement The Company is committed to ensuring the confidentiality, integrity, and availability of all information assets under its control. In compliance with applicable laws, regulations, and contractual obligations, the Company adopts appropriate information security measures to protect its information assets against intentional or accidental internal and external threats. To achieve this objective, the Company hereby establishes and announces the following information security principles and practices: Risk Management and Compliance The Company conducts information security risk assessments in consideration of relevant laws, regulations, and operational requirements. Based on the assessment results, appropriate information security management procedures and controls are implemented to ensure the protection of information assets. Roles, Responsibilities, and Awareness The Company establishes evaluation and assessment mechanisms based on personnel roles and responsibilities. Information security education, training, and awareness activities are conducted as necessary to enhance employee understanding and compliance. Access Control Management Access rights to information assets are granted strictly according to business requirements and are governed by the principles of least privilege, segregation of duties, and independent review. Incident Management and Business Continuity The Company has established information security incident management procedures to ensure timely response, control, and resolution of security incidents. Business continuity plans are defined and periodically tested to maintain the continuous operation of information systems and services. Protection of Personal Data and Intellectual Property The Company handles and protects personal data and intellectual property in accordance with the Personal Data Protection Act and applicable Intellectual Property laws, ensuring lawful and appropriate use. This policy shall be communicated to all employees and relevant stakeholders and shall be reviewed periodically to ensure its continued effectiveness and alignment with regulatory and business requirements.