Skip to main content

Information Security Management

Information Security Policy

In an era of rapid digital transformation, implementing robust information security measures and protecting customer privacy have become essential corporate responsibilities. Brim Biotechnology ensures the highest level of data and privacy protection by establishing the Information Security Management Guidelines and Information Access Control Standards, which together strengthen the security and integrity of all information assets.

Management Guidelines

Brim has established the Information Security Management Guidelines to define the fundamental principles and procedures of information security. These guidelines ensure that only authorized personnel have access to sensitive information, thereby reducing both internal and external information security risks.

Regular Drills and Testing

To enhance the Company’s ability to respond to information security incidents, Brim conducts annual social engineering tests and training exercises to assess employees’ awareness of potential cybersecurity threats. In addition, regular backup and restoration drills of critical systems are carried out to prevent data loss during unexpected events and to ensure rapid recovery, minimizing operational downtime.

Implementation and Maintenance of the Information Security Management System

Brim invests in the establishment and maintenance of a comprehensive information security management system that includes firewalls, network switches, and endpoint protection tools to secure the Company’s network environment. Meanwhile, the Company leverages Google Workspace Security and the Dingxin Enterprise Cloud Management Platform to perform efficient security monitoring and management, enabling timely responses to potential threats.

Information Security Incident Reporting Procedures

In responding to unexpected information security incidents, prompt and effective reporting and handling procedures are crucial. To ensure that such incidents are reported in a timely manner and addressed efficiently, the Company has established the Information Security Incident Reporting Procedure. This procedure ensures rapid escalation and response, minimizing the impact of security events on business operations.

Incident Reporting

When information system users from various units confirm the occurrence of an information security incident, the IT system responsible person must report the facts to the company’s superior within 30 minutes and provide timely updates on the handling progress.

Establishing and Managing Records

After assessing the impact scope, establish management records. The Information Security Team must conduct an investigation of the information security incident, assess the incident level, and request support if it is determined that independent recovery is not possible.

Emergency Response

Propose, decide, and implement emergency response measures, and confirm the results of the handling.

Lifting Management Records

When the system resumes normal operation, the information unit must notify relevant units to lift the management records and complete the “IT-001-01-h Information Security Incident Report Form” for record-keeping.

Level Incident Status
A All critical systems interrupted
B Several critical systems interrupted
C Single critical system interrupted
D Causes a temporary business interruption but no recovery required
E Control failure, but does not affect business operations, injuries, or losses