Information Security Policy and Measures
Information Security Policy and Measures
TEON has formally established an Information Security Policy as the foundation of our security management framework. This policy reflects our commitment to safeguarding the security and privacy of all stakeholders—including employees, customers, suppliers, partners, and shareholders—as well as operation-related information assets. It ensures the confidentiality, integrity, availability, and legality of information assets, while reducing risks from internal and external, deliberate or accidental threats.
Our Approach
Information security is embedded in every aspect of our operations. We focus on strengthening systems, protecting data integrity, and responding swiftly to potential threats. By fostering accountability among employees and extending security standards to partners and suppliers, we ensure privacy and information protection remain integral to sustainable business practices.
Governance and Standards
To achieve this, LITEON has established an ISO 27001-certified Information Security Management System, adopting the PDCA cycle for continuous improvement. We obtained ISO 27001:2013 certification in 2020 and upgraded to ISO 27001:2022 in 2024. The current certificate is valid from July 1, 2026, to July 1, 2029.
Our information security governance framework is overseen at the highest level by the Board-level Corporate Sustainability Committee. The Cybersecurity Subcommittee is a formal subcommittee of the Board-level Corporate Sustainability Committee and is responsible for overseeing cybersecurity governance, cyber risk management, information security performance, and cybersecurity resilience across the Group.
At the executive level, our governance framework includes a cross-functional Information Security Committee,
LITEON also participates in industry alliances such as the Taiwan Information Security Management Association, Taiwan Information Security Alliance, and High-Tech Information Security Alliance to strengthen capabilities.
Scope and Responsibilities
The scope of information security covers employees, clients, suppliers, shareholders, and all IT systems, software, and hardware associated with business activities. All employees sign the Code of Professional Ethics and receive annual training to raise awareness and integrate security into daily operations. Suppliers and partners must comply with LITEON’s security requirements, including confidentiality agreements to protect customer privacy and personal data.
Integrated Risk and Continuity Management
Information security is embedded in our Business Continuity Management System (BCMS) to prevent threats, limit damages, and ensure rapid recovery. This approach aligns with ISO 27001 and supports factories in maintaining resilience against disruptions.
Key Measures
- Threat Monitoring & Vulnerability Analysis
Real-time monitoring via Security Operation Center (SOC), regular vulnerability scans, third-party security ratings, and continuous threat exposure management, including dark web intelligence and penetration testing. - Data Protection
Azure Information Protection (AIP), encryption, identity verification, secure remote access, and Microsoft Office 365 tools to safeguard sensitive information in office and remote work environments. - Industrial Control Security
IEC62443-based controls for production IT systems, including network segmentation, device authentication, virus protection, portable device control, and backup mechanisms to prevent disruptions. - Network Security
Zero-trust architecture, endpoint protection, strict identity verification, and SD-WAN for centralized network management and application visibility. - Internal and External Audits
Internal audits are conducted by a dedicated team of 10 security specialists and 30 representatives from business units, following the PDCA cycle. Independent external audits verify compliance and include ISO/IEC 27001:2022 and ISA/IEC 62443 certifications.
Incident Reporting and Response
Employees can report vulnerabilities or suspicious activities through internal channels to the IT department or dedicated security unit. A structured escalation process ensures timely response and corrective actions.
In July 2024, during a routine inspection, LITEON detected an anomaly. Immediate network isolation and defense mechanisms were activated, and detection protocols were strengthened. The incident had no financial or operational impact.
Training and Awareness
All employees complete mandatory annual training (minimum one hour), with role-specific courses on privacy and security. New hires sign the Code of Conduct and receive onboarding training. Additional external training for auditors and random social engineering exercises are conducted to reinforce awareness.
Physical and Access Control
Advanced access control systems and trained security personnel protect offices and factories. Breaches trigger corrective or disciplinary actions, including warnings, demerits, or termination.
Performance and Transparency
In 2025, LITEON reported zero material breaches and no complaints related to privacy or data loss. Customer data was not used for secondary purposes. These results are disclosed in the Annual Report (pages 130–132) and ESG Report (Section 3.5 Information Security and Privacy Management).
Information security management campaign and blueprint |
Privacy Protection Management
LITEON places a high priority on privacy and personal data protection. The Company has implemented a Personal Information Management System (PIMS) and established a Personal Data Protection Management Policy together with supporting procedures. These provide guidance for the lawful and secure collection, processing, use, storage, transfer, and disposal of personal data.
LITEON implements its personal data protection system through defined governance responsibilities, risk assessments, document control, internal controls, audits, employee training, incident response procedures, and continuous improvement. In 2025, no complaints related to customer privacy breaches or customer data loss were reported.
Privacy Policy
Group-wide Coverage, Including Suppliers
LITEON’s Personal Data Protection Management Policy applies across the Company, including its subsidiaries, branches, offices, business units, and functional units. The policy also applies to employees, contracted and dispatched personnel, and business partners working with LITEON, including customers, suppliers, consultants, and other third parties.
Suppliers and other third parties that receive or process personal data are required to implement privacy and data protection measures in compliance with applicable laws and regulations. Where personal data is disclosed externally, appropriate confidentiality and data protection requirements are established to protect data subjects and ensure consistent privacy standards across LITEON’s value chain.
Privacy Governance and Responsibilities
LITEON has established a Personal Data Protection Committee responsible for coordinating, planning, auditing, and promoting personal data protection across the Company. The Committee is convened by the Chairman or President, or by a person designated by them, and comprises senior representatives from relevant business units and corporate and operational functions.
Operational implementation is supported by the LITEON Data Protection Officer, Local Data Protection Officers, Legal & IP Center, HR Center, IS & IT Center, and relevant business and functional units. Their responsibilities include formulating and communicating privacy policies, updating documents in response to regulatory changes, providing employee training and privacy consultation, overseeing data subject rights requests, and serving as the primary contact for regulatory authorities and privacy incident reporting.
Integration into Enterprise Risk, Compliance, and Internal Control
Privacy and personal data protection are integrated into LITEON’s group-wide Enterprise Risk Management and compliance framework. Information security is included within the scope of operational risk, and relevant functions conduct risk assessments covering information security and personal data protection.
Risk improvement plans are implemented based on assessment results and incorporated into the Company’s risk management activities. The implementation of the Personal Data Protection Management Policy and related privacy protection mechanisms is also included in LITEON’s internal control self-assessment and internal audit activities.
Corrective and Disciplinary Actions
Violations of LITEON’s Personal Data Protection Management Policy are handled in accordance with the Company’s Reward and Violation Management Method and the applicable rules of its subsidiaries, branches, and offices.
Corrective or disciplinary actions are determined according to the nature and severity of the privacy violation and may include termination of employment or the relevant contractual relationship. This mechanism applies to personnel and other parties subject to the policy and reflects LITEON’s zero-tolerance approach to privacy violations.
Audit and Continuous Improvement
LITEON incorporates the implementation of its Personal Data Protection Management Policy and related privacy protection mechanisms into its internal control self-assessment and internal audit activities. The Company reviews corrective actions for identified issues and continuously strengthens its privacy management through privacy audits, external website inventory assessments, document updates, system enhancements, and employee training. The Personal Data Protection Management Policy is reviewed at least annually, with relevant records and supporting evidence retained for review and audit. As part of the establishment and enhancement of LITEON’s privacy management framework, the Company’s Personal Information Management Process was independently reviewed by Deloitte & Touche. LITEON also maintains ISO/IEC 27001 certification for its Information Security Management System, supporting the broader control environment for information security and personal data protection.
Personal Data Protection Internal Control and Audit Mechanism
To ensure that the collection, processing, and use of personal data comply with the Personal Data Protection Act and relevant regulations, the Company has established a comprehensive personal data management system and internal control mechanism. Through regular internal audits and continuous improvement processes, we strengthen compliance and risk control in privacy protection.
Our personal data protection practices cover the following key points:
-
All personal data is collected for specific purposes and in accordance with legal requirements. Any use beyond the original purpose must also comply with legal provisions.
-
Data subjects are clearly informed of the necessary information before collection, and written consent is obtained.
-
The accuracy of personal data is regularly reviewed, and corrections, supplements, deletions, or cessation of use are carried out upon the data subject’s request.
-
A request mechanism is in place for data subjects to exercise their statutory rights, with clearly defined procedures and required documents.
-
Personal data files and processing equipment are subject to security control mechanisms and are managed in accordance with the Information Security Management Regulations.
-
Employees are obligated to maintain confidentiality and are required to undergo regular training on personal data protection to enhance compliance and information security awareness.
Internal Audit System
To ensure the effectiveness and continuous improvement of the personal data management system, the Company has incorporated personal data protection into its internal audit plan and, based on a risk-oriented approach, regularly conducts the following audit activities:
- Audit frequency and scope: At least once a year, audits are conducted on processes such as the collection, processing, use, storage, and deletion of personal data, covering all departments and information system operations.
- Audit items: Include whether there is a legal basis for collection, whether data subjects are clearly informed, whether valid consent is obtained, whether use beyond the original purpose is compliant, data accuracy maintenance, procedures for exercising data subject rights, equipment and environmental security controls, and implementation of training programs.
- Audit methods: Include document review, system sampling, on-site interviews, and field inspections, conducted by the Internal Audit Center.
- Deficiency tracking and improvement: Audit results are compiled into reports for management review. Responsible units are required to complete corrective actions within a specified period. Major deficiencies are reported to the Board of Directors.
- Continuous improvement: Audit results also serve as a basis for revising policies and planning training programs to ensure that personal data protection practices keep pace with the times.
Through institutionalized audit and improvement processes, we are committed to strengthening a culture of data protection, reducing potential risks, and enhancing stakeholder trust in our privacy governance.
