Information Security

Information Security

  • Information Security Organization​

SAS established its Information Security Committee in March 2023. The committee members are comprised of the highest-ranking information or information security officers from the company’s subsidiaries. Since its inception, the committee has convened biannually, but starting from December 2024, meetings will be held quarterly. The committee aims to coordinate the formulation, implementation, risk management, and compliance of policies related to information security.

To integrate information security management policies and risk management into daily operations, SAS also requires each subsidiary within the group to establish its own Information Security Task Force. Members of these task forces are representatives from various departments, who discuss and communicate information security matters relevant to their departmental operations during meetings. They are responsible for implementing the information security policies and practices set forth by the Information Security Committee.

Additionally, SAS incorporates information security into performance evaluations. The Information Security Office at SAS headquarters tracks the performance indicators of information security implementation at all group locations on a monthly basis. Based on operational needs, it provides information security goals, improvement guidelines, and necessary resource support to help achieve the group’s overall information security objectives. Departments are also required to implement the resolutions of the Information Security Committee, share experiences in improving information security, establish a group-wide joint defense mechanism, and enhance the overall information security framework.

SAS has established a Information Security Manager and an information security organization to lead the execution of the company’s information security operations and the effectiveness of information security risk management mechanisms. At least once a year, the Information Security Manager reports the effectiveness of information security management and the strategic direction of information security to the Board of Directors. The overall information security management organization and the execution effectiveness of related information security operations and systems are supervised by Chairperson Hsiu-Lan Hsu, who has a background in computer science. These are regularly reviewed and revised.

  • Information Security Governance and Continuous Improvement

SAS has established an information security policy and information security management procedures, utilizing the PDCA (Plan, Do, Check, Act) cycle to ensure the achievement of established goals and continuous improvement.

 

Security Testing

Data Protection Measures

Personnel Management

Network Security Protection

Security testing is regularly implemented, including host vulnerability scanning and system updates.

Data protection measures. Regular backups and proper storage, management of external information storage media, minimization of access privileges, account and password complexity restrictions, etc.

Regular training for employees, periodic information security awareness campaigns, supplier access management, and regular social engineering drills.

Firewall rule reviews, secure remote connections, realtime monitoring of traffic and anomalies, and regular operational continuity drills. 

  • Information Security Management Programs

Sino-American Silicon Products Inc. has established an Information Security Incident Management System. When employees identify an information security incident, system vulnerability, abnormal activity, or any other suspicious event, they are required to immediately report it to the responsible personnel in the Information Technology Department and Information Security Department through the established reporting mechanism. Through incident reporting, classification, response, and follow-up improvement procedures, the Company ensures that information security risks are identified and controlled in a timely manner. In the event of a major information security incident, the Company will activate a cross-functional response process to promptly conduct impact assessments, implement risk control measures, and execute corrective actions, thereby continuously strengthening information security governance and operational resilience.

  • Information security knowledge and awareness training
  • Information Security Managers and Information Security Officers of all subsidiaries convene Information Security Committee meetings on a quarterly basis.
    All employees are required to participate in information security awareness and training programs annually. In 2025, each employee completed at least two information security-related training courses.
  • Each dedicated information security professional (currently two designated information security personnel) completed an average of 30 hours of professional information security training during 2025.
  • The vulnerability scanning and monitoring score for externally facing systems achieved a rating of 96 points.
  • The Company engaged a professional cybersecurity service provider to conduct Red Team exercises to enhance its ability to detect, respond to, and defend against potential cyberattacks.
  • Information security KPIs are established and periodically audited by the Information Security Committee to enhance the organization’s cybersecurity maturity. In 2025, 100% implementation of three key indicators was achieved across all subsidiaries.
  • Information Security Strategy and Operating Model

SAS is committed to the responsible, safe, trustworthy, fair, and human-centered development and use of artificial intelligence (AI). To enhance operational efficiency and innovation while effectively managing risks and fulfilling its social responsibilities, SAS established the AI Use and Security Management Guidelines in 2026. Approved by the General Manager, the Guidelines apply to all employees, contract personnel, interns, and personnel of external service providers.
SAS has established a comprehensive AI governance framework encompassing risk classification, data protection, human oversight, bias prevention, record retention, auditing, and continuous monitoring. This framework ensures that AI is used for clearly defined purposes, with risks appropriately controlled and roles and responsibilities clearly assigned. AI applications that are high-risk or may have a significant impact must undergo appropriate risk assessments, reviews, and approval procedures. Human-in-the-loop controls must also be implemented, with authorized personnel reviewing AI outputs to ensure that AI does not directly replace professional judgment or decision-making.
SAS places a high priority on protecting personal data, confidential information, and intellectual property. AI applications must comply with applicable laws, regulations, and company policies and must incorporate appropriate information security and privacy safeguards. All outsourced, cloud-based, and third-party AI services must undergo security and privacy risk assessments to ensure compliance with the Company’s information security and compliance requirements.
SAS prohibits the use of AI for any purpose that violates laws or regulations, infringes privacy, or causes bias, discrimination, or unfair impact. The Company also prohibits high-risk uses involving manipulation, social scoring, or biometric identification without lawful authorization. Both internal and external AI applications must provide an appropriate level of transparency and explainability. The relevant business units with designated responsibility remain ultimately accountable for the adoption of AI-generated outputs and the resulting decisions.
SAS continues to promote AI talent development and organizational learning. From 2025 to 2026, the Company conducted nine AI training courses and six cross-functional AI study group sessions covering data protection, enterprise applications, AI assistants, and related topics. Through cross-functional collaboration and practical application, these initiatives strengthen employees’ AI literacy and capacity for innovation while supporting the long-term advancement of responsible AI.

  • ISO 27001 Certification

SAS implement Information security management system (ISO 27001). We actively enforce to improve the performance of ISMS to ensure the effectiveness management system of ISMS.