Regulations Governing the Internal Controls and Audit System for Postal Remittances and Savings Article 34-1

Chunghwa Post shall assign a manager ranking vice president or higher or an individual with equivalent position to serve concurrently as the chief information security officer, who shall oversee the implementation and coordination of the information security policy and resource allocation.Chunghwa Post shall set up a dedicated information security unit with independent function, arrange suitable workforce and equipment, and appoint a person with the rank higher than that of the head of the office or equivalent position to serve as the chief officer of such unit.The staff and the chief officer of the dedicated information security unit under the preceding paragraph shall not be appointed to other posts in charge of information or tasks with conflicts of interest.The dedicated information security unit is in charge of planning, monitoring, and implementing the management processes of information security. Chunghwa Post shall submit, disclose, and publish the internal control system statement in accordance with the regulations in Paragraph 1 of Article 11 and the chief information security officer shall co-sign and issue the statement.The personnel of the dedicated information security unit of Chunghwa Post shall attend at least fifteen (15) hours of professional courses regarding information security or on-the-job training every year. The personnel of the head office, business units (post office branches of all levels), information units, assets safekeeping units, and other management units of Chunghwa Post shall attend no less than three hours of information security courses every year.