{"id":7608,"date":"2024-07-30T03:48:01","date_gmt":"2024-07-29T19:48:01","guid":{"rendered":"https:\/\/esg.gamania.com\/information-and-cyber-security\/"},"modified":"2026-09-30T01:26:12","modified_gmt":"2026-09-29T17:26:12","slug":"information-and-cyber-security","status":"publish","type":"page","link":"https:\/\/esg.gamania.com\/en\/information-and-cyber-security\/","title":{"rendered":"Information and cyber security"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Information and cyber security<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Information
Security<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The Company has established the “Group Information Security Policy,” which is approved by the CEO and serves as the guideline for the Group’s establishment of information security and network security management systems and procedures, as well as information and communication management related to computer system hardware and software. The policy aims to ensure the confidentiality, integrity, and availability of the Company’s important information.
Key elements include: conducting regular evaluations of the information security management system; establishing mechanisms to ensure confidentiality, integrity, and availability of information and prevent unauthorized access; receiving internal and external threat intelligence and performing risk assessments and penetration testing; requiring all employees to comply with the policy and promptly report incidents; and requiring third-party partners to undergo security assessments and include information protection obligations in contracts. The Company also implemented firewalls, threat monitoring and analysis, vulnerability scanning, hacker simulations, drills, and backup operations. In 2025, no violations of customer privacy or legal penalties occurred.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Information security management<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The \u201cInformation Security Committee of the Group\u201d is the highest guiding organization for the Company\u2019s information security. The Group CEO serves as the highest supervisor, and oversees the implementation of various information security management measures by committee members to demonstrate the full support for the information security management system. The organizational structure of the committee is as follows. The committee is composed of commissioners designated by various departments, including but not limited to the head and division-level executive members. In 2023, the headquarters of the Group further appointed an \u201cInformation Security Officer,\u201d with the division-level management unit of the Information Service Division managing information security-related matters, and with a professional security technology team commissioned to assist in providing the necessary information security services.<\/p>

<\/p>

Two Information Security Committee meetings chaired by the Group\u2019s CEO were held in the year to review the performance of the current security management system, assess operational risks and related response plans, and review the progress of the annual information security projects.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Under the guidance of the Group’s operational strategies and government laws and regulations, the committee is responsible for formulating the overall information security policy, promoting security protection measures, patching system vulnerabilities, monitoring abnormal incidents, and responding to major events. Gamania has fully implemented the PDCA management cycle (Plan – Planning and Assessment, Do – Design and Implementation, Check – Review and Audit, Act – Review and Improvement) to ensure consistency between what is said, documented, and done in the risk management system. With continuous improvement at its core, the cycle enhances the security and resilience of operations and services. Through a comprehensive cyclical framework of risk assessment, rolling policy revisions, protective infrastructure development, monitoring management, and vulnerability patching, we continuously track the latest information security trends. This allows us to flexibly adapt to different information service models, operating environments, and regulatory requirements, thus ensuring that our information systems and network services operate stably within controllable risk tolerances.<\/p>

To enhance cybersecurity governance and execution effectiveness, the Group has established various functional teams under the Information Security Committee, including the Policy and Information Security Technology Promotion Team, Executive Team, Audit Team, Risk Team, and Emergency Response Team. The “Group Information Security Organization Management Regulations” clearly define the responsibilities and authorities of each team to continuously advance information and communication security matters and provide feedback on security management indicators for information security governance. The teams work together and complement one another. The detailed division of responsibilities is shown in the figure below.<\/p>

At the same time, the information units also regularly conduct information security assessments, inventories of information assets, reviews of operating systems, determination of business impacts (including MTPD, RTO, and RPO), and information security measurements.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Information security management strategy and specific management measures<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The Company’s information security strategy focuses on three key dimensions: people, systems, and management. In compliance with national laws and regulations, the Company manages customer and member data assets through risk-based analysis and controls.<\/p>