The “Corporate Governance and Sustainable Development Committee" is responsible for promoting business ethics. The Company has business ethics related regulations such as “Ethical Corporate Management Best Practice Principles”, “Procedures for Ethical Management and Guidelines for Conduct”, “Corporate Governance Best-Practice Principles”, “Corporate Sustainable Development Best Practice Principles”, and “Ethical Conduct Best Practice Principles”; 

The company provides customer satisfaction in accordance with our Ethical Conduct Best Practice Principles and strives to compete in the marketplace in an honest manner and does not use illegal or unethical means to gain results. Chailease Holding and its significant subsidiaries in Taiwan were not involved in any corruption and bribery, fraud, insider trading, anticompetitive, antitrust and monopolistic practices, and there were no lawsuits and penalties related to market manipulation in 2023.

All directors and senior executives of the Company have signed the "Integrity Statement" which has been disclosed on the Company's website. The Integrity Statement declared that the Company and all of its employees shall not directly or indirectly offer, promise to offer, request or accept any improper benefits, nor commit unethical acts for purposes of acquiring or maintaining benefits while engaging in commercial activities, in order to implement the integrity management policy, actively prevent dishonesty, and declare the determination and commitment of the board of directors and senior management to operate in good faith. All new recruits must attend the course on the Ethical Corporate Management Best-Practice Procedure and Code of Conduct, and regular training was also provided for existing employees.

In order to further enhance ethical management, the Company has implemented the ISO 37001 Anti-Bribery Management System, and formulated the “Anti-Corruption and Anti-Bribery Policy”, the prevention of corruption and bribery, the guidance for the stakeholders so as to prevent the corruption and bribery, the establishment of the ethical management policy, and the implementation of corporate social responsibility and sustainability are set forth in the Policy.

Chailease’s ISO 37001 Anti-Bribery Management System received certificate from BSI in May 2023, and passed the validity audit in January 2024. Currently, the scope of the ISO 37001 Anti-Bribery Management System is Chailease Holding Company Limited, the Company will evaluate the possibility of extending the scope of the system to subsidiaries.

The company’s policy regarding director insurance goes beyond current legal requirements. Since going public in 2012, the company has purchased liability insurance for our directors. In August 2017, during a special shareholder meeting, the Articles of Association were revised to add retired directors to the scope of compensation, while indemnity agreements shall also be signed by each director. At the same time, the company purchases Directors and Officers Liability Insurance to prevent erroneous actions taken by directors and supervisors and company officers in the process of their executive duties to cause damages to third parties and provide them with a means to pursue a claim. The insurance also helps to mitigate financial risks to the company caused by litigation and ensure healthy company operations.

Insurance for "Employee Integrity Risk", with the company listed as the insured, prevents and protects against dishonest actions by employees which might cause grave damage to the company (such as legal or financial accounting personnel), and cause the loss of company assets or assets the company is charged to steward. This will offset operational risk onto an insurance liability, reducing losses to the company and thereby protecting shareholder interests.

The Company and its subsidiaries have established the Whistle-Blower Policy, Procedures for Protecting Whistle-Blower, the Regulations of Prevention, Correction, Complaint and Punishment of Sexual Harassment, and the Regulations of Prevention, Correction, Complaint and Punishment of Unlawful Violations in Workplace have also been established as well. Personnel within and people outside of the company can report improper actions, corruption, or actions in violation of the Code of Conduct through the channels of the established public hotlines, the e-mail mailboxes on the official website, and the traditional mailbox. The Whistle-Blower Policy specifies the dedicated receiving units, the independent investigation units, and the acceptance and investigation schedule for misconduct and malpractice. If the unlawful infringement (includes: discrimination, sexual and non-sexual harassment) has been verified, Chailease may transfer, demote, cut pay, punish employees or impose other punishments on the employees based on relevant regulations such as working rules, depending on the severity of the unlawful infringement. If the investigation result shows that a criminal case, Chailease will help complainants take legal actions, and transfer the case to judicial authorities.

After being verified without false allegation or incomplete information, the report or the complaint raised will be investigated by the independent investigation unit depending on the nature of the report or the complaint. When the allegations of the report or the complaint is substantiated, the appropriate disciplinary action in accordance with the Company’s Personnel Reward and Punishment Regulations will be taken. Internal publicity to comply with the Company’s discipline and regulations will be enhanced.

The “Procedures for Protecting Whistle-Blower”require that the whistleblower should be kept strictly confidential. All information disclosed during the course of investigation should remain confidential.

In order to implement the ISO 37001 Anti-Bribery Management System, the Company has amended the “Whistle-Blower Policy “and “Procedures for Protecting Whistle-Blower”, the amendments mainly include adding and channeling the reporting method for different event, regulating different investigation items for different level of the management, and strengthening the whistle-blower protection.

Among the concerns or complaints raised to the Company and its subsidiaries in the year of 2023, 34 reported cases have been investigated and substantiated. The employees who violated the Company’s discipline or regulations have been punished in accordance with the Company’s Personnel Reward and Punishment Regulations and internal publicity has been carried out.(Note: 59 employees involved in the above 34 cases represent approximately 0.6% of the total population of the Company’s 9,887 employees by the end of 2023.)

In order to effectively promote information security work, the Company established the “Information Security Committee” in accordance with the “Regulations for Information Security Policy,” to take charge of promoting and governing information security, monitoring and managing information security risks, and reporting major information security incidents. The Committee shall hold a meeting at least once a year and may hold a meeting to report major decisions to the Board of Directors, if necessary.

In 2022, according to the “Regulations Governing Establishment of Internal Control Systems by Public Companies”, set up Chief Information Security Officer, information security supervisor, and information security dedicated department. Professional information security personnel will coordinate the information security management system and compliance, information security analysis and monitoring, threat and vulnerability management, incident response, etc.

Considering relevant business development and demands, the Company established the “Information Security Policy” to strengthen the management of information security, build a safe and reliable information operating environment, and ensure information, system, equipment and network security. Moreover, the Company also stipulated “Guidelines for the Management of Information Security” and other management regulations and established control systems, in accordance with relevant matters stated in the policy. For the content of relevant policies, please refer to the Important Articles of Incorporation for Company Governance on the company website.

In accordance with the provisions of Article 8 and 9 of the "Regulations Governing Establishment of Internal Control Systems by Public Companies", Chailease has established internal control systems and related operational specifications for information circulation and other management environment, including personal information, and computerized information system. Simultaneously, to comply with the provisions of Article 13 of the Regulations, our company information and communication security inspection is included in the annual audit plan.

In order to implement the self-supervision mechanism of information communication safety, ensure the implementation of the information cycle and personal information processing-related internal control systems can be adjusted in time in response to changes in the environment, so as to reduce the risk of negligence in information communication safety operations. In accordance with relevant internal and external laws, regulations, and risk assessment results, each unit decides on its own assessment procedures and methods. The frequency of execution depends on the nature of the work of each unit. It must be handled at least once a year, and the defects and abnormalities found in the assessment will be proposed for improvement. The results of the self-assessment are sent to the internal audit unit for review and review of the implementation of the self-assessment.

The independent internal audit department shall draft an annual information security audit and inspection plan according to the results of self-risk evaluation and risks of each operation unit. This audit and inspection plan shall be submitted to the management and the internal audit department shall conduct due diligence based on the plan. Reports of due diligence will be submitted to the management. Defects and recommendations thereof will be tracked and improved within a due date.

Each unit's new recruits are required to attend education and training classes encompassing courses of specific information security, the company's internal rules, related laws, cybercrime, and general knowledge of information security. Each year, information technology-related departments shall establish an annual education and training program and arrange personnel to participate in external workshops accordingly. Those participating in training courses will also need to pass relevant professional examinations. We also arrange companies with expertise to introduce (or educate about) important information security projects and conduct related case studies.

Regarding the management of the information service processing procedure, Chailease takes information management as its basis and builds demand management, incident management, problem management, change management, requisition form management, online management, knowledge management, and usability management, supplemented by risk management orientation, from the demands of information services at the user end to the final completion online or solutions to problems or demands, to keep close tabs on information security.

With the rapid advancement of technology and the increasingly complex challenges in information security, the protection of sensitive data within enterprises cannot be overlooked and a robust information security culture is crucial for the stability of business operations. The promotion and training of information security awareness among employees are key success factors in implementing information security policies. Information security training not only enhances employees' awareness but also effectively reduces the information security risks associated with internal errors or malicious actions. Recognizing this, the company actively invests in information security education resources and consistently takes note of effectiveness.

1. Newly onboarded personnel are required not only to receive relevant internal professional knowledge but also to complete information security training and become familiar with internal information security policy requirements. This is to proactively prevent potential risks. As of 2023, all new employees have successfully completed the training.
2. The company has also planned various information security courses on different topics for all employees, providing an efficient way to learn information security knowledge while meeting the training requirements. All current employees have undergone training in 2023.
3. Regularly conducting social engineering simulation drills to enhance employees' awareness and preparedness against actual threats. Additionally, these drills serve to verify the effectiveness of training efforts.
4. Establishing an 'Information Security Awareness Announcement' to regularly disseminate information on information security topics, techniques for recognizing fraudulent methods, etc. This aims to remind employees to be vigilant, understand the importance of information security, and stay informed.
5. To cope with the rapid changes in information technology, the Information Technology Department annually sends employees to participate in external professional training courses related to information security.

Information Technology Department provided gateways and terminal protection function, as well as quarantine alert for the virus program. Moreover, the department can further detect external suspicious intrusion behavior through network flow control and analysis. In addition, to improve threat detection speed and response time, XDR (Extended Detection and Response) was introduced comprehensively to collect and automatically cross-correlate data from multiple protection layers to provide faster threat detection through more rapid information security analysis, and to improve investigation and response time.

Enterprise Mobility Management (EMM) was gradually introduced. When employees use mobile devices to send and receive emails or perform remote connection operations, the authority is minimized and controlled according to the principle of “Need to know”, and ensure that no storing of data in endpoints. In other words, to truly protect the company operational information and customer personal information, it will not be possible to store company data externally from mobile devices.

Set up a dedicated department for information security and formulate daily information security inspection operations to ensure that all information security equipment can perform detection and defense capabilities as expected. Discover and eradicate potential external and internal threats information security risk by analyzing the warning signs and records generated by the equipment. Integrate information security equipment with operating processes to prevent threats before they happen.

In response to the company's heightened concern for sensitive data security in 2023, the implementation of Data Loss Prevention (DLP) technology has been successfully completed in Taiwan. The DLP system enables real-time monitoring, detection, and prevention of potential information leaks, ensuring the continuous surveillance of sensitive data usage. Monitoring reports are also regularly provided to mitigate the risk of data breaches proactively.

To establish a zero-trust foundation, the company has implemented a multi-factor authentication system in 2023. By combining different authentication factors, this move aims to strengthen the identity verification mechanism, providing higher security than single account password authentication. This ensures that only authorized personnel can access company resources, thereby reducing the risks of improper system usage and identity theft.

Completed the vulnerability scanning of the servers and the penetration test of the main website in 2023. This involves scrutinizing potential vulnerabilities in servers and websites to ensure their resilience against various potential threats. Following the completion of the assessment, we integrating the assessment report with current security control measures to evaluate the vulnerability risk levels under the information environment control. Subsequently, we formulate and implement a vulnerability remediation plan. The security assessments are conducted twice a year to ensure real-time control of new vulnerabilities and threats.

The vulnerability scanning platform was established in 2023. In addition to conducting vulnerability scans through external vendors regularly, this platform also enables real-time responses to emerging information security threats. It integrates with internal operational processes to proactively detect potential security vulnerabilities and validate the effectiveness of remediation for vulnerabilities. This aims to establish a more comprehensive vulnerability management system.

Completed the phishing e-mail drill in 2023. Phishing emails designed to be close to hacker attack methods were sent to all employees to test their information security vigilance and awareness in Taiwan. After statistical analysis of the drill results, information security training materials were designed, information security awareness announcement was established and published regularly to help employees understanding the latest social engineering techniques and improve the overall level of information security awareness continuously.

Implementing information security insurance in 2023. Making the risk transfer of financial aspects of information security impacts, mitigating the damage and impact of information security incidents to enhance the company's risk tolerance and resilience.

In response to potential risks such as information security, human rights, privacy, ethics, and legal implications arising from the global wave of generative AI, referencing "Reference Guide for the Use of Generative AI by the Executive Yuan and Affiliated Agencies," the company has formulated internal "Guidelines for the Use of Generative AI" in 2023. This aims to provide employees with consistent usage principles and awareness, ensuring safe, reasonable, and effective utilization to mitigate potential information security risks.

In 2023, two disaster recovery environment drills were conducted in accordance with the regulations, one for the information department recovery drill and one for the remote recovery about information department and the front end and back end. This exercise is to provide the best protection measures for the enterprise s internal systems and data, minimize the recovery time from system interruptions and reduce the data loss caused by operational interruptions through reasonable means and methods. In 2023, there were no fines or operational losses due to information equipment problems.

To standardize procedures for reporting and handling information security incidents, "Regulations on Incident Response and Notification Management for Information Security Events" was optimized in 2023. Processes for incident classification, severity levels, and response handling were established. In the event of an information security incident, actions will be taken within specified timeframes based on the severity level to complete damage control or recovery operations. After the incident is resolved, root cause analysis will be conducted, and corrective measures will be implemented to prevent recurrence.

When the enterprise pursues continuous operation, and complies with the international standard management system to achieve the goal of organizational operation safety, thereby enhancing customer trust and becoming the most reliable partner:

1. The ISO 27001 information security management system (ISMS) was introduced in 2021, and renewal was passed in 2022 and 2023, maintaining the validity of the international certification with a continuous optimization attitude. In 2024, "SEM financing platforms" will be included in the scope of verification to expand and expand year by year.
2. Implementing information security insurance in 2023. The goal is to establish the risk transfer mechanism. While pursuing sustained operations, the company aims to meet the expectations of stakeholders by demonstrating a high commitment to information security through tangible actions