Information Security Policy -“Integrating IT and risk management mechanisms to safeguard group competitiveness and sustainable operations.”

The Company has been certified under the ISO/IEC 27001:2013 Information Security Management System (ISMS) since 2014, and successfully completed the transition to the updated ISO/IEC 27001:2022 standard in 2025. To ensure the uninterrupted operation of global information services, we continuously strengthen and improve our ISMS to effectively mitigates risks including the unauthorized alteration, disclosure, destruction, or loss of business information arising from intentional or accidental internal or external threats.

Information Security Objectives

• Quality: Ensure the accuracy and completeness of information to enhance administrative efficiency and service quality.
• Availability: Ensure the availability of information systems and IT infrastructure to support continuous business operations.
• Privacy: Safeguard trade secrets and protect the privacy of all stakeholders.
• Security: Comply with applicable laws and regulations and international security standards to ensure business continuity.

Our Implementation Policies

• Foster information security awareness, responsibility, and accountability among all employees, subsidiaries, joint ventures, suppliers, and contractors.
• Conduct comprehensive information security and cybersecurity training programs to ensure all personnel understand information security principles and fulfill their individual responsibilities.
• Proactively require suppliers and contractors to comply with Yang Ming's Information Security Policy. The Company's Supplier Code of Conduct also specifies cybersecurity requirements that all suppliers conducting business with the Company are required to comply with.

Certifications