XML 26 R8.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management, Strategy, and Governance
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

ITEM 16K. CYBERSECURITY

The audit committee of the board of directors receives, reviews and discusses the periodic reports regarding the company's information technology and security matters, which include cybersecurity incidents, assessments of new and emerging cybersecurity risks and threats, and proposed improvement measures.

We have cybersecurity processes and guidelines designed to mitigate the risks of a security breach or cyber-attack. These guidelines define the information security and cover measures of employee responsibility, information security coordination, data governance and classification, access controls and identity management, system & network security, operations & availability, system & network monitoring, asset inventory and device management, data center security management and business continuity and disaster recovery.

We have also established guidelines describing the procedures for reporting and responding to cybersecurity incidents. The guidelines define and classify cybersecurity incidents, specify the division of responsibilities, and designates incident reporting flows in accordance with the materiality level of the incidents. Once an incident is detected, identified and reported, a team led by responsible manager (for a less severe incident) or IT division head (for a material incident) will be assembled for responding to the incident. The team will comprise personnel for information gathering and planning, damaging controlling, recovering and evidence tracing and preserving, as well as for public communication and administrative, legal and financial supporting. Besides the responding measures, the team will also perform analyses for incident cause as well as the actions and recommendations in order to prevent or mitigate similar incidents in the future. Follow-up meetings or periodic review will be in place to evaluate the result of these actions and recommendations.

We have implemented real-time monitoring mechanisms for the cloud services. In case of any material incidents, relevant IT personnel will be notified promptly via email, and corresponding procedures will be followed in accordance with the company policies designed to minimize operational impacts. Additionally, we regularly obtain Service Organization Controls (SOC) reports from our third-party service providers to assess the effectiveness of their control measures.

The head of IT division is responsible for assessing and managing the cybersecurity risk and reporting on cybersecurity matters to the audit committee of the board of directors. Our head of IT division obtained his master degree in Graduate Institute of Computer Science, National Tsing Hua University and has over 20 years of experience working in information technology.

Other professionals in our IT division also have cybersecurity experiences or certifications. Our IT division regularly assesses potential threats and takes a comprehensive view of cybersecurity risks. We have not engaged any third-party service provider to assist on risk assessment processes.

As of the date of this annual report, we do not believe that any past cybersecurity incidents have had, or are reasonably likely to have had, a material adverse effect on the Company’s business, operations or financial condition. See “Risk Factors—Risks Related to Cybersecurity and Technology Infrastructure.”
 

Cybersecurity Risk Management Third Party Engaged [Flag] false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Role of Management [Text Block]

The head of IT division is responsible for assessing and managing the cybersecurity risk and reporting on cybersecurity matters to the audit committee of the board of directors. Our head of IT division obtained his master degree in Graduate Institute of Computer Science, National Tsing Hua University and has over 20 years of experience working in information technology.

Other professionals in our IT division also have cybersecurity experiences or certifications. Our IT division regularly assesses potential threats and takes a comprehensive view of cybersecurity risks. We have not engaged any third-party service provider to assist on risk assessment processes.

Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The head of IT division is responsible for assessing and managing the cybersecurity risk and reporting on cybersecurity matters to the audit committee of the board of directors.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our head of IT division obtained his master degree in Graduate Institute of Computer Science, National Tsing Hua University and has over 20 years of experience working in information technology. Other professionals in our IT division also have cybersecurity experiences or certifications.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true