Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 25

The matters to be performed by the dedicated information security unit shall at least include:1. Taking charge of the planning, management, and execution of the information security system to manage information security risks.2. Supervising each unit in implementing the information security system, and ensuring the confidentiality, integrity, and availability of communication systems, services, and information.3. Establishing mechanisms related to cyber security protection, assessment and response to cyber security intelligence, and reporting of and response to cyber security incidents.4. Incorporating the overall implementation of information security from the preceding year into the assessment of the implementation of the internal control system referred to in Paragraph 1 of Article 8 annually.