Information Security Management | Corporate Governance | Philosophy | ASUS ESG website, ASUS ESG goal
Information Security Management
Information Security Management Organization Vision
After the rapid progress of digital transformation, the application of emerging technologies, including cloud services, the Internet of Things, and generative AI, has expanded, creating new threats of cyberattacks, as well as the continuous impact of supply chain cybersecurity on enterprise business continuity. In addition, the evolution of attacks, such as ransomware and social engineering, has caused great damage to numerous organizations. Lastly, as the government and industry tighten their oversight measures, companies are required to comply with applicable laws, regulations, and standards. Against this backdrop, ASUS continues to implement risk assessment and management, strengthen internal control mechanisms and external collaboration, and raise cybersecurity awareness among employees. In response to the ever-changing cybersecurity challenges, the company is also constantly monitoring the development of emerging technologies and the threats they pose.
Jonney Shih, Chairman of ASUS, instructed the establishment of the Information Security Committee in May 2020, which reports to the Chairman and implements the information security strategy as directed by the Chairman. The Information Security Committee's monthly meeting is attended by Ted Hsu, Vice Chairman of ASUS, and S.Y. Hsu and Samson Hu, Co-CEOs of ASUS, who are all members of the Board of Directors. They are leading the Committee on several information security projects. The projects include supply chain information security, privacy protection and cloud service security based on the ISO management standards, and internal coordination required to achieve relevant information security compliance. In addition, in September 2021, ASUS appointed the Chief Information Security Officer (CISO). In the same year, the company also established a dedicated information security team, the Digital Security Center, which is responsible for comprehensive planning and strengthening of information security and product security. With the vision of "Building Digital Resilience, Enhancing Brand Trust. Pursuing Excellence in Security," the Digital Security Center serves as a powerful support for the company's subsidiaries, customers, and supply chain partners. The CISO reports annually to the Board of Directors on ASUS' information security risk and project performance and results delivered by the Digital Security Center.
As the global information security challenges are intensifying, requiring cross-border support and collaboration between the public and private sectors, Jonney Shih instructed the CISO to meet with public sector officials and expressed our willingness to take the lead in bringing various sectors together. Later, in July 2021, ASUS established the High-Tech Information Security Alliance with the help of the Taiwan Network Information Center (TWNIC) and Taiwan Computer Emergency Response Team / Coordination Center (TWCERT/CC), and in April 2022, with the help of the Taipei Computer Association, the company established the Taiwan Chief Information Security Officer Alliance, which is currently the largest user-centric information security alliance with about 190 company members whose total annual revenue exceeds NT$15 trillion.
Information Security Management Performances in 2023
Information Security Governance
The Information Security Committee promotes the Information Security Management System, establishing management procedures that comply with international standards. It plans, implements, and reviews internal information security activities, and verifies various activities and their related results to meet the objectives and requirements of the Information Security Management System.
Information Security Program
Conducting information security incident investigations and improving protection and response drills to evaluate the level of the Group’s information security defenses. Additionally, the company implemented social engineering drills to prevent commercial email fraud, using the standards set by the Executive Yuan’s National Information and Communication Security Taskforce (NICST) as the benchmark. Security awareness training was provided to employees and new hires globally, with courses available in 18 languages. The company continually emphasized the Group’s Information Security Ten Rules, sending formal email reminders to employees who violated the rules, requesting improvements, and reporting these incidents to the highest department supervisors as part of individual performance evaluations.
Digital Resilience
In 2021, the “High-Tech Information Security Alliance” was established, aiming to enhance defensive capabilities through regular exchanges within the alliance. In 2022, the cross-industry “Taiwan Chief Information Security Officer Alliance” was formed to improve industry cybersecurity resilience. To strengthen product security development, relevant Open Source testing mechanisms were introduced to research and development units, and policies were formulated and implemented. Additionally, Open Source SSDLC & License educational training was conducted for the R&D teams. In 2022, led the efforts in establishing the Taiwan Chief Information Security Officer Alliance, which now has more than 100119 publicly traded or OTC companies as members to improve the information security resilience of domestic industries jointly. In 2023, ASUS invested in the construction of national critical information infrastructure, including the establishment of the National Center for High-Performance Computing - “Taiwania-4” supercomputer project, ensuring that the country’s critical computing platforms meet the National Cybersecurity Grade A Protection level.
Risk Management
We pay attention to various digital security risks and help internal units to adopt and implement the BCM risk assessment, risk management, and crisis management plans and grasp the implementation status of various drills. Improve the response and handling speed of information security incidents of maintenance and monitoring teams.
Personal Data Protection Committee
ASUS established the "Personal Data Protection and Information Security Committee" in April 2012 according to the instruction from the top management to formulate the company's policy on personal data use and handle relevant matters. In response to regulatory changes and reorganization, the above committee has changed to the "Personal Data Protection Committee" (Hereinafter referred to as "the Committee") in 2018, and the Committee has released a new company's policy named the "General Personal Data Protection Policy" and implemented it internally. The Policy is used as guideline on the collection, processing and use of personal data collected through ASUS products and services (such as computers, software, official websites, customer support services and others). The Committee published the "ASUS Privacy Policy" on ASUS official website to let the general public and consumers aware of how ASUS protects and manages their personal data.
In order to ensure the full implementation of the company's policies, the Committee holds regular bi-weekly meeting to implement and review annual objectives, and calls irregular meetings from time to time to adjust implementation measures and handle personal data relevant events. By the end of 2023, the Committee has held 320 regular meetings.
Main accomplishments of the Personal Data Protection Committee in 2023
Data inventory review
Continue to examine the nature of data collected, processed and used by the company to ensure the scope of regulatory compliance.
Process improvement
The Committee elaborates to the relevant departments on the data processing procedures that shall be modified and improved to be in accordance with personal data protection laws in response to the update of products or services.
Privacy policy review
Adjust the ASUS Privacy Policy for each country in response to regulations from different jurisdictions if needed.
Education and training
Education and training sessions are held annually to ensure all employees understand the company's policy. In 2023, 6 sessions were provided to employees in headquarters and in overseas offices.
Handle the request and inquiry of data subjects and supervisory authorities
The Committee is the central contact point for handling requests and inquiries of data subjects and supervisory authorities. ASUS shall respond to the requests from data subjects within the statutory period by law. The Committee collaborates with the relevant departments to handle requests and responds to the data subjects to fulfill the regulatory obligations. Inquiries from the supervisory authorities are also handled with the same approach to mitigate legal risks.
Annual internal audit
The responsible departments involved in the management of personal data are included in the scope of audit to cooperate the company's internal audit. With internal self assessment conducted by the departments, examination of service providers' practices conducted by the departments, and audits conducted by auditors, the Committee provides corrective measures and improvement approaches on non-compliant items to assist the responsible departments or service providers to improve their practices to ensure the full implementation of the company's policies and relevant management procedures.
Main plan for Personal Data Protection Committee in 2024
- Review and improve the Company's compliance procedures in response to new legislation in Asia-Pacific and Americas.
- Add overseas audits and assist related authorities in performing supplier audits.
Data Protection Measures or Regulations
- Ensure confidentiality of relevant business information, prevent sensitive information and customer private information from various threats and damage due to internal or external, deliberate or accidental factors, which exposes business information under risks such as modification, exposure, damage or missing.
- Ensure the completeness and availability of relevant business information and thus correctly carrying out the operation, and to protect security of information assets.
