Information Security Management Policy and Measures
Our Company actively promotes information applications and digital transformation while emphasizing the protection of information security and personal data. Therefore, we have appointed several information security specialists and a dedicated information security manager. Additionally, our Company is a member of the Taiwan CERT/CSIRT Alliance and Taiwan CISO Alliance under the Ministry of Economic Affairs. All employees adhere to the “Kedge Construction Information Security Policy” approved by the Board of Directors, ensuring the protection of information security in response to identified risks and security norms. Furthermore, in accordance with the “Information Security Management Operational Procedures” developed by the Information Technology department, various information security operational procedures and responsibilities are planned and executed. The Information Security Manager supervises the implementation effectiveness.
To promote the Company’s information and communication security-related policies and implement information and communication security practices and audit requirements, an “Information and Communication Security Promotion Group” has been specially established to continuously strengthen information and communication security protection and the overall management and joint defense mechanisms for information and communication security intelligence. The organizational structure is shown in the diagram below
The General Convener of the Information and Communication Security Promotion Group is held by the Company’s General Manager, and the Information and Communication Security Management Representative is responsible by the Information Security Officer. Under this structure, the “Information and Communication Security Response Group,” “Document Control Group,” and “Information and Communication Security Audit Group” are established. Members of each group are appointed by the convener and are responsible for planning and implementing information security operations and promoting and implementing information security policies. They report information security implementation status to the Board of Directors regularly every year.
The management of the Company’s information and communication security incidents follows the “Information Security Incident and Accident Operating Standards.” The General Convener of the Information and Communication Security Management Promotion Group appoints personnel to form an “Emergency Response Implementation Group” according to task organization to be responsible for business continuity management and major information security incident handling. Information security incidents are classified according to procedures to determine whether they constitute information security accidents. Rapid notification according to procedures and appropriate necessary handling or response measures are taken to reduce potential damage from accidents and prevent similar accidents from recurring.
Information and Communication Security Policy
The Company’s Information and Communication Security Policy is formally codified in the ISO 27001 document “K01-1-IT-1-Information and Communication Security System Manual.” Designed to address identified risks and compliance requirements, the policy aims to safeguard all information resources― ensuring the total security of data, information systems, equipment, and networks across the Company, its subsidiaries, and affiliates. This robust framework mitigates operational disruptions caused by cybersecurity incidents, guarantees business and service continuity, reduces operational risks, and maximizes return on investment. The core policy directives include:
6. Every employee bears a fundamental responsibility to maintain information security and must comply with all internal cybersecurity management guidelines.
7. The IT departments of each subsidiary are required to establish localized cybersecurity operational procedures, conduct periodic and ad-hoc reviews of security policies, monitor operational compliance, and report performance outcomes to the Board of Directors on an annual basis.
8. The Company shall proactively update its cybersecurity maintenance protocols in alignment with evolving legal regulations and technological advancements. This ensures that information systems and data are robustly protected against unauthorized access, use, control, leakage, disruption, tampering, destruction, or other forms of infringement, thereby guaranteeing the confidentiality, integrity, and availability (CIA triad) of all information assets.
9. The Company shall reinforce the resilience of its core information systems by engineering comprehensive business continuity plans (BCPs) for cybersecurity and conducting regular practical drills to guarantee uninterrupted business operations.
Specific Cybersecurity Management Initiatives
Pursuant to the “Information and Communication Security Operational Management Procedures,” the Company continuously elevates its security posture across four strategic pillars: “Cybersecurity Protection,” “Incident Response,” “Institutional Governance,” and “Personnel Training,” detailed as follows:
Allocate dedicated capital and operational resources to continuously strengthen information and communication security management.
The Company actively promotes information application and digital transformation while placing great importance on information and communication security and personal information protection. The Company has appointed dedicated Information Security Officers and Information Security Engineers responsible for the Company’s information security planning, technology implementation, and related audit matters to maintain and continuously strengthen information security. Furthermore, the Company achieved ISO 27001:2022 Information Security Management System (ISMS) certification in 2024 and successfully passed its surveillance audit in 2025. The current certificate is valid from November 29, 2025, through December 12, 2027.
To fortify our technical capabilities and defensive perimeter, a budget of approximately NT$13.36 million (averaging NT$17,000 per employee) was allocated in fiscal year 2025 toward implementing cybersecurity software and hardware, alongside dedicated security enhancement services. To drive sustained improvements in cybersecurity governance, the Company continues to reinforce its overarching digital resilience through a multi-pronged approach encompassing institutional policy establishment, advanced technical safeguards, and continuous employee training. In fiscal year 2025, the Company recorded zero major cybersecurity breaches, personal data leaks, or operational disruptions stemming from security incidents. :
Employees are the most vulnerable link in enterprise attacks. To strengthen employees’ information security awareness, help employees recognize the importance of information security, and adopt corresponding security measures, the Company commissions external professional consulting teams to conduct at least two information security awareness enhancement courses for colleagues annually, making these courses mandatory for all colleagues.
Information Security Awareness Enhancement
Strengthening Information Security Protection – Successful Implementation and Certification of ISO 27001:2022 ISMS
To ensure the confidentiality, integrity, and availability of the Group’s business information and to fully protect the privacy of employees and customers, Kindom Group simultaneously launched an implementation project for the latest ISO 27001:2022 standard in April 2024 across its three major business entities―Kindom Development, Kedge Construction, and Global Mall. An Information Security Management System (ISMS) was established for core systems, e-commerce platforms, and customer membership systems. The project schedule and key tasks are as follows:
The ISO 27001 international information security standard adopts the Plan-Do-Check-Act (PDCA) management cycle. During project implementation, Kindom Group’s Information Technology Department introduced a variety of security testing tools and established a comprehensive ISMS framework incorporating 114 information security controls. Information security awareness training, communications security, and information security incident handling are incorporated into process controls. Through the implementation of the ISMS, the Group has strengthened the planning and execution of information asset management, cybersecurity risk assessment, outsourced service management, and information security incident response. These measures not only help reduce the likelihood and potential impact of cybersecurity incidents such as cyberattacks, data breaches, and business interruptions, but also ensure compliance in IT operations, improve overall operational efficiency, and enhance corporate competitiveness.
Goals and Outlook
Looking ahead, the Company will continue to enhance its network and information and communications systems architecture in accordance with high standards. In addition to strict compliance with applicable laws and regulations, all employees are required to rigorously implement information security management requirements. Through ISO 27001 certification, the Company will build comprehensive cybersecurity protection capabilities through mechanisms such as information asset and risk assessments, business impact analysis and monitoring, and business continuity exercises. Information security awareness and concepts will be further embedded into the corporate culture, while the Company continues progressing toward a Zero Trust network architecture to enhance corporate security and strengthen its competitiveness for sustainable operations.
Through the efforts of the Information and Communication Security Promotion Group and continuous process improvements, Kindom Development, Kedge Construction, and Global Mall successfully passed the audit and verification conducted by SGS Taiwan at the end of 2024 and obtained ISO 27001 information security certification. The three companies passed the surveillance audit in 2025, and the current certificates are valid from November 29, 2025 to December 12, 2027.
