Cybersecurity Guidelines for Listed Companies

2. Strengthening Cybersecurity Across Three Key Dimensions

Policy Management: Setting Policies and Objectives

In any initiative, setting policies and objectives is like laying a project's foundation — it determines the direction of every subsequent issue and the ultimate outcome. To build our blueprint, we need to:

• Establish a Dedicated Security Team: Team members aren't just figureheads — they're responsible for driving, coordinating, and overseeing all security matters, with clearly defined cross-departmental responsibilities. Policies and objectives must be approved by a deputy general manager or higher and reviewed regularly, so every security task is measurable and traceable, allowing management to see results and adjust policies promptly.
• Conduct an Asset Inventory: Comprehensively inventory all of the company's information assets, classify each by confidentiality, availability, and business impact, and compile core systems (such as customer databases, confidential company documents, and payment platforms) into an “Information Asset Register” so you always know which systems are most critical and valuable to the company, optimizing resource allocation.
• Plan Response Procedures: Define how to respond to and report a security incident should one occur — including clear Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), as well as backup mechanisms and plans to minimize losses.

Dedicated Security Team Staffing Requirements

Staffing requirements for the dedicated security team follow Article 9-1, Paragraph 2 of the “Regulations Governing Establishment of Internal Control Systems by Public Companies,” implemented on a phased basis, with scope and timeline as follows:

Technical Protection: Security Risk Management

Once strategy and objectives are set, the next step is to translate the blueprint into concrete protection and control measures, ensuring every security policy is actually implemented:

• Access Control and Protection: Implement multi-factor authentication (MFA) and tiered access permissions, allowing only authorized users or groups to access specific data. Log every access event in detail — including changes to critical data, detected attacks, unauthorized connections, functional errors, and administrator actions — and establish appropriate protections for these logs.
• Perform Vulnerability Patching: Take corrective action on security vulnerabilities in systems, applications, or networks. The VANS Vulnerability Reporting System can automatically match software asset vulnerabilities, support software asset inventory (CPE), keep track of potential vulnerabilities (CVE) in critical information systems, and dispatch patches.
• Implement Security Controls: Segment independent logical network zones based on business needs (e.g., DMZ, internal/external networks), and isolate development, testing, and production environments. Deploy multi-layered protections — antivirus software, network firewalls, email filtering, intrusion detection/prevention systems (IDS/IPS), advanced persistent threat (APT) defense, and a security operations center (SOC) — to provide real-time attack alerts, effectively block various types of attacks, detect threats quickly, and respond promptly to minimize risk.

Awareness Training & Social Engineering: Implementing Effective Education and Training

The most important element in any enterprise is its people. Regular education, training, and simulated exercises raise employees' security awareness.

• Security Education and Training: Communicate corporate security policies — such as rules for software installation, email, instant messaging, personal mobile devices, and portable media — and promote key security news and related courses.
• Social Engineering Drills: Send simulated phishing emails to employees, such as fake internal system alerts or fraudulent customer quote requests, and provide additional security training to employees who fail the test.
• Join Security Information Sharing Organizations: Gain access to early-warning intelligence and threat/vulnerability information through organizations such as industry Information Sharing and Analysis Centers (ISACs) and the Taiwan Computer Emergency Response Team / Coordination Center (TWCERT/CC).

3. What DragonSoft Can Offer

By deploying comprehensively across policy management, technical protection, and awareness training & social engineering, establishing a dedicated security team, and setting quantifiable metrics, management can track progress at any time. Asset inventory and vulnerability patching processes reduce system risk, while multi-layered defenses and identity access controls — paired with regular drills and intelligence sharing — form a security system where people, process, and technology work together. Only through this closed-loop approach of continuous review and improvement can an organization remain resilient in an ever-changing threat landscape and protect its core value and long-term sustainability.

DragonSoft offers security health checks, asset inventory, and vulnerability patching products and services to help enterprises build a reliable cybersecurity protection system that safeguards their core value and sustainable development in an ever-changing threat landscape.

Security Assessment Consultation　Listed Company Security Documents Zone