Integrity and Transparency

• Completed an access control list (ACL) for computers of high risk endpoints (1,113 computes in total), and installed the unified threat management (UTM) system on key equipment (10 in total) to lower the scope affected by risks.
• Installed an information security monitoring system on OT equipment to monitor the list of assets and network topology, implement vulnerability management and risk assessment, and use AI for big data analysis, so as to achieve early discovery of potential threats.
• Added "supply chain information security threat"; the Company plans to implement differential management through supplier classification; design a self-evaluation form for suppliers to evaluate the current status of their information security, and then use suppliers' self-evaluation results and attributes as the basis for classification; conduct on-site audits for key high-risk suppliers.
• The goal is to complete audits of (3) high risk suppliers before November 30, 2023.

The sales of DRAM products are mainly conducted in US dollars. The Company established an offshore subsidiary at the end of 2018 to reduce the impact of exchange rates on the US dollar positions held by the parent company. In the future, we will continue to periodically review and manage the US dollar positions and implement the following practices:

• Convert the US dollar cash to the New Taiwan dollar and keep the lowest US dollar positions.
• Evaluate the use of pre-selling Foreign Exchange Forward to lower the exchange rate risk of accounts receivable.
• Evaluate the increase in debt denominated in US dollars to offset the exchange rate risk of accounts receivable for retention of reasonable US dollar net positions to reduce the impact of appreciation. (depreciation) in New Taiwan dollars on profit and loss

• Under the continued operation of ISO45001 & ISO14001 management systems, the Safety and Hygiene Division continues to identify potential EHS risks. We have established indicators and continue to monitor low risk hazards. For medium and high risks, we proposed and implemented improvement plans, and presented the risks that were identified and their control measures in quarterly risk management meetings.
• Risk management will focus on expansion (construction) projects (parking lot, expansion of the new Fab 5A) in 2022, and will mainly aim to prevent occupational accidents from occurring in the construction process. The Company appointed additional personnel to carry out daily inspections and audits of the expansion area. Furthermore, project audits and management is carried out in coordination with the related departments. We also participate in monthly meetings of the construction site collaboration organization and deficiency improvement reviews, in hopes of eliminating or reducing the risk of severe occupational accidents during the expansion (construction) period.
• We have consistently directed our efforts to the implementation of Enterprise Risk Management (ERM), and we continue to identify potential risks and implement management measures for different levels of risk to mitigate the impact of incidents. We continue to improve our BCP/BCM to rapidly recover from impacts and reduce losses.

• Compliance with the Personal Data Protection Act: In response to the personal data protection regulations of the European Union, United States, China, and Taiwan, the Company has obtained the consent or authorization of employees and customers and updated labor contracts and employee manuals of overseas subsidiaries to ensure employee and customer privacy. With regard to cross-border transmission of information, we have signed cross-border agreements that comply with the regulations of each country or the official version agreements, and immediately update the versions to ensure their effectiveness.
• Compliance with the climate change regulations: The Company became a founding member of the Semiconductor Climate Consortium (SCC) in 2022, and strives to continue reducing GHG emissions through technological innovations and maintaining close communication with members of the SCC. The Company publishes annual progress reports on the 3 major scopes of carbon emissions each year. We set short-term and long-term carbon reduction goals in coordination with government policy, in order to achieve net zero emissions by 2050. Carbon emission reduction measures are included in the planning and design of new fabs. The best available control technology (BACT) is used for air pollution prevention equipment. The prohibition or restricted use of GHG with high warming potential are prohibited or restricted, and may affect the use of process raw materials. We will evaluate a voluntary reduction plan to offset our emissions, and pay carbon fees according to the type of emissions, which may increase operating costs. The Company has low risk of being ordered to suspend operations.
• Intellectual property protection: The Company has formulated an intellectual property management strategy and deepened its patent portfolio. We also included the protection of trade secrets into the training course for new employees, and require employees to strictly abide by their obligation of confidentiality. The Company established information security management regulations to protect data safety and customer privacy. We raise employee awareness to protect the Company's confidential information and improve their knowledge of regulatory compliance through education and training, thereby lowering the risk of information leakage. The implementation progress is reported to the Board of Directors each year, and is disclosed on the official website.
• Compliance with antitrust regulation: The Company has collaborated with legal experts of different countries, periodically gathered international antitrust standards and enforcement status, and comprehensively promoted the compliance with antitrust regulations to the staff. Currently, we have only one antitrust lawsuit case being appealed in the courts in Brazil, and this has no material impacts on our operations.