Make sure your computer, smartphone or tablet is secure by updating operating systems, web browsers and other software. Also install antivirus software from a trusted company to ensure your device is protected from malicious activity.

The Bank ensures the confidentiality, integrity and availability of information, and prevents unauthorized access, alteration or destruction.

The information security and business continuity management objectives align with the Bank’s goals.

The Bank clearly define the responsibilities and obligations of employees in information security and business continuity management, and assign relevant management roles responsible for providing direction and oversight.

Regularly evaluate the risk assessment of information assets and adopt appropriate control and treatment to eliminate or reduce information security risks.

To maintain continuous operation of information systems, the Bank establishes mechanisms for monitoring information security threats, incident response, and business disaster recovery. Regular exercises and tests are conducted to reduce business impact and ensure alignment with the Bank’s business continuity objectives. In the event of an information security incident, actions shall be taken in accordance with the "Chang Hwa Bank Information Security Event Reporting Procedure" and the "Chang Hwa Bank Material Incident Process Procedure". The Bank will proactively inform affected stakeholders about the incident handling and subsequent improvement measures based on the nature and impact of the incident.

The Bank establishes information security requirements and management mechanisms for suppliers and third parties, clearly specifying that all partners must comply with the Bank’s Information Security Policy.

To ensure the effectiveness of information security risk management framework, CHB adopts “Three lines of defense” to assure on the effective management of information security risks. The first line of defense includes all departments and the IT Division being responsible for executing information security operations. The second line of defense is the Information Security Division monitoring the executing status of the Information Security Policy and the deriving security risks. The third line of defense is the Internal Auditing Division, which checks the operations.

Regularly review and amend the Information Security Policy, and take effect upon approval by the Board of Directors.

Regularly report information security risk and management to Risk Management Committee, and report at least annually to the Board of Directors.

Prepare a cybersecurity budget every year, and allocate approximately 37% of the annual IT budget to cybersecurity in 2024. 

Continue to introduce and expand information security defense equipment, such as firewall, anti-virus, IPS, information security log management system, database audit monitoring system, malware endpoint detection system, and replace the expired equipment.

Continue to improve the information security and business continuity management system, and implement compliance operations as required by the competent authority, to ensure the effectiveness of information security management.

Regularly perform information security assessment and various information security tests, such as penetration test, vulnerability scanning, malicious program detection and mobile application security testing, etc.

The Bank conducts information security testing at frequencies aligned with the criticality of each information system. For example, external-facing websites, apps, and electronic payment platforms undergo vulnerability scans quarterly and penetration tests semiannually; network devices undergo annual vulnerability scans and penetration tests. Furthermore, each system has established timelines for vulnerability remediation based on its risk score and risk level.

Regularly conduct information security training, social engineering drills for all personnel and carry out emergency response and system backup drills for IT and Information security staff, to improve the information security response capabilities of colleagues.

Continue to conduct information security joint defense and make good use of information security intelligence, to strengthen the ability to prevent malicious attacks and detect threats.

There are about 20 employees in our Information Security Division, and the Bank's employees have obtained 101 international information security certificates, such as CISM, CISSP, CISA, OSCP, CEH, CPENT, CCISO.

Report to the Risk Management Committee on the information security risk and management every month.

ISO 27001 and ISO 22301 Management Reviews are held twice a year.