1. Definition of Information Security

Information security means ensuring and maintaining the “confidentiality*1,” “integrity*2,” and “availability*3” of information assets.

1. Only authorized users can access the information, and the information is not disclosed externally.
2. Information and information systems are accurate, and established handling procedures are followed.
3. Authorized users can access information and information systems as needed.

2. Purpose

By handling information assets appropriately, we aim to earn the trust of customers, business partners, shareholders, employees, and other stakeholders and fulfill our social responsibility as a company.

3. Scope of Application

1. This policy applies to all organizations within the Company.
2. This policy applies to all Company personnel, including officers, employees, temporary staff, part-time workers, casual workers, and interns, as well as contractors who are stationed at Company offices to perform their duties.
3. This policy applies to all information related to business activities under the Company’s control.

4. Objectives

1. Prevent information security incidents and minimize their occurrence.
2. If an information security incident occurs, minimize the damage and ensure business continuity.

5. Risk Management Framework

We conduct risk assessments and risk management in accordance with the framework below and establish control objectives and measures.

1. Identification and Classification of Information Assets
   Accurately assess the importance of information assets within the Company and classify them accordingly.
2. Risk Assessment
   Establish criteria for evaluating risks and conduct risk assessments.
3. Risk Management
   Implement administrative, physical, and technical risk controls.

6. Other Information Security Principles

1. Compliance with Information Security Obligations
   Comply with laws and regulations (including, but not limited to, (1) the Unfair Competition Prevention Act, (2) the Act on Prohibition of Unauthorized Computer Access, (3) the Copyright Act, and (4) the Act on the Protection of Personal Information, as specified in the Information Security Management Regulations), internal rules, and contractual information security obligations.
2. Education and Awareness Activities
   Conduct education and awareness activities related to information security.
3. Business Continuity Management
   Address interruptions to business activities caused by major information system failures or disasters, protect critical business processes, and ensure the resumption of business activities and critical processes.
4. Disciplinary Measures for Violations
   Apply disciplinary measures to persons who violate the Information Security Policy.
5. Responsibility for Information Security Management
   General and specific responsibilities for information security, including responding to information security incidents and making external reports when necessary, rest with the Company's management.
6. Information Security Management System Documentation
   We create and maintain information security management system documentation to appropriately manage information security and use this documentation to implement this policy.

Established March 15, 2015