Information Security Management

Information Security Framework and Policy

In recent years, global cyberattack activities have become increasingly prevalent, and information security threats have continued to emerge. These not only pose a risk of significant financial loss to enterprises but can also cause irreparable damage to their reputations. To address information security risks, EGAT has established a comprehensive information security management system. In addition to implementing the ISO 27001 information security management system, the company underwent a recertification process and an external audit in 2025. In the same year, it developed an information asset inventory and risk assessment management system to monitor the use of company terminals and block non-compliant software.

EGAT set up the Information Security Management Division, and cybersecurity governance and related decision-making across the company are directed by the designated information security executive. EGAT also established the Information Security Promotion Committee, chaired by the President, to ensure top-down collaboration and clear delegation of authority and responsibility. This structure reinforces information security awareness among all employees and ensures the realization of information security objectives. At the policy level, EGAT adheres to the principles of ISO 27001, formalizing the information security management system through documentation and establishing the Information Security Policy and Information Security Management Manual as the Company’s core references for information security management practices. At the management level, EGAT set measurable information security objectives, conducted regular assessments of information security performance, and carried out continuous improvements through mechanisms such as internal and external audits, corrective management, and management review meetings, ensuring the effectiveness of information security management.

EGAT ISO/IEC 27001 and CNS 27001 certificates — EGAT’s ISO/IEC 27001 and CNS 27001 certification.

Investment in Information Security Management

Item	Concrete Management Measures
Item Information Security Measurement	Concrete Management Measures Established measurable indicators for key control measures aimed at reducing risks and regularly recorded measurement results. Analyzed and reviewed measurement results for each indicator to assess the effectiveness and adequacy of the control measures.
Item Information Security Incident Management	Concrete Management Measures Formulated reporting procedures for the identification and escalation of information security incidents and events. Established a response and handling process for information security incidents to ensure timely and appropriate management.
Item Business Continuity Management	Concrete Management Measures Developed business continuity plans (BCPs) for critical business operations, including activation and execution procedures. Conducted regular drills to verify the adequacy of the business continuity plans and minimize the impact of disruption events.
Item Network Security	Concrete Management Measures Advanced technologies are introduced to perform computer scanning and system software updates. Strengthen firewalls and network access controls to detect and block suspicious threat connections. Regularly assess or test network system security, promptly rectifying security risks and vulnerabilities in the network operating environment. Deploy devices for Internet behavior management and filtering to control internet access, prohibiting access to harmful or policy-prohibited network addresses and content. Implement threat detection and management for information security by providing advanced threat warnings and conducting multidimensional correlation analysis of critical equipment logs (such as firewalls, Intrusion Prevention Systems (IPS), and AD servers). This process helps issue alerts regarding potential ongoing attack threats in real time, while also offering recommendations for post-event defense or emergency response.
Item Device Security	Concrete Management Measures A network connection mechanism for computer devices is deployed to prevent unauthorized devices from entering the Company’s network. Endpoint antivirus measures are deployed to enhance detection of malicious software behavior. Implement threat detection and response managed services, conducting comprehensive risk assessments of computer equipment, including user account behavior investigations, program memory forensics, and network activity analysis. Restrict administrator privileges for terminal devices to prevent misuse of privileged accounts and mitigate the risks of malicious software installation and lateral movement propagation. Establish a terminal resource management platform to collect hardware and software specifications of terminal devices, strengthening equipment compliance management.
Item Application System Security	Concrete Management Measures Assign system users access based on the principle of least privilege (PoLP), providing the minimum authorization access required to perform job functions and deleting them after personnel changes or resignations. Utilized digital electronic signatures during processes to ensure the security and authenticity of signatory information. Regularly conduct source code inspections to identify web program security vulnerabilities and ensure the security of online system services. Implement procedures for system account password changes, access monitoring, and log audits.
Item Data Protection Security	Concrete Management Measures Establish processing regulations for managing and storing classified and sensitive data and set up appropriate protective measures such as outgoing mail control, access permissions, and data encryption and masking. Strengthen control over portable storage media, usage rules, and regular review mechanisms. Before decommissioning data equipment, remove storage media and physically destroy them to prevent leakage of personal data and business confidentiality, then process them according to relevant procedures.
Item Contingency and Recovery Mechanism	Concrete Management Measures Regularly review emergency response plans. Conduct regular system recovery drills for important systems every year. Establish a system backup mechanism and implement offsite backups.

Information Security Training

In 2025, EGAT conducted the following information security training programs, offering tailored courses for different employee groups to enhance information security awareness.

Training Topic	Training Description	Resources Invested
Training Topic Information Security Awareness Campaign	Training Description Raised awareness of information security risks among all employees to protect the EGAT’s digital assets and strengthen cybersecurity resilience.	Resources Invested 3,494 persons
Training Topic Social Engineering Defense	Training Description Enhanced employees’ awareness and vigilance against phishing emails and social engineering attacks.	Resources Invested 3,383 persons
Training Topic Social Engineering Protection Training Course	Training Description Introduce common social engineering techniques and phishing email types to high-risk users to enhance employees' cybersecurity awareness.	Resources Invested 594 hours

Information Security Reporting Channels

Information security incident reporting procedures for EGAT employees are posted on the Company's internal portal. Clear reporting guidelines are provided to ensure that employees can report and address information security risks in a timely manner.

Personal Data Protection

To protect customer rights and ensure compliance with data protection laws and regulations, as well as to protect the personal data held by the Company from being stolen, altered, damaged, destroyed, or leaked, EGAT has established a “Personal Data File Security Maintenance Plan” outlining operational procedures for personal data protection in detail. In 2025, EGAT experienced no cybersecurity or privacy-related complaints involving data breaches, violations of customer privacy, or loss of customer data, nor were there any instances of data leakage.