ISO 27001 Certification & Information Security Policy Statement

At NetPro, we are committed to building a secure and reliable information environment by adhering to the ISO 27001 standard. Our goal is to strengthen information security awareness across the organization, ensure business continuity, and safeguard the interests of all stakeholders. This Information Security Policy applies to all employees and third parties, outlining our core principles and management objectives.

Information Security Policy Statement

We recognize the critical role of information security in sustaining long-term business operations and protecting the interests of our customers, partners, and stakeholders. Guided by the belief that “Information Security is a fundamental workplace standard,” we lead our teams to implement and maintain information security in alignment with ISO 27001, making it a core competency for all employees.

We pledge to maintain a secure and trustworthy IT environment that responds to the growing complexity of cyber threats and ensures uninterrupted business operations. This policy outlines the fundamental principles, management goals, and implementation priorities for our information security practices. It applies to all staff, partners, and any third parties accessing or utilizing NetPro’s information assets.

Core Principles of Information Security

  1. Confidentiality, Integrity, and Availability (CIA) of Core Systems
    Protect sensitive information from unauthorized access, disclosure, or use. Ensure data accuracy and integrity, preventing unauthorized changes, damage, or loss. Guarantee that authorized users can reliably and promptly access systems and services when needed.
    　
  2. Comprehensive Legal and Regulatory Compliance
    We commit to complying with all applicable laws, regulations, industry standards, contractual obligations, and internal policies related to information security. Regular compliance checks and risk assessments ensure that our controls meet the latest standards.
    　
  3. Continuous Improvement of the ISMS
    We maintain and enhance our Information Security Management System (ISMS) through ongoing assessment, monitoring, and corrective actions to manage risks effectively.
    　
  4. Enhanced Awareness and Organization-wide Participation
    Regular training sessions are conducted to improve employee awareness of security risks and promote safe practices in daily work routines.

Information Security Objectives

Comprehensive management of information assets
Continuous improvement and proactive risk management
Strengthening employee security competencies
Building trust among stakeholders

Key Areas of Information Security Implementation

  1. Establishment of an Information Security Committee
    A dedicated committee oversees the development, implementation, monitoring, and regular review of security strategies.
    　
  2. Policy Review
    Information security policies are reviewed at least annually or upon significant changes to ensure alignment with business developments, legal updates, and technological advancements.
    　
  3. Implementation of Security Controls
    　
    • Physical Security: Data centers and server rooms are protected with access controls and surveillance systems.
    • Network Security: Safeguards include firewalls, VPNs, regular monitoring, and log analysis.
    • Access Control: Based on the principle of least privilege with regular user rights audits.
    • Endpoint Protection: Security policies for all endpoints, including BYOD, with mandatory antivirus installation.
    • High Availability Infrastructure: Routine maintenance, monitoring, and backup procedures are enforced.
    • Incident & Disaster Recovery Management: Established response and recovery plans with defined responsibilities and routine testing.
    • Change Management: Standardized procedures for handling new or modified operations.
    • Document Control: Classification, versioning, and archiving protocols.
      　
  4. Secure Software Development Lifecycle (SDLC)
    Security is integrated into each stage of the development lifecycle, including testing and vulnerability remediation.
    　
  5. Vendor Security Management
    All vendors undergo security assessments, and agreements are established with periodic reviews of their security performance.
    　
  6. Security Awareness Training
    Ongoing education to improve employee understanding of various security threats.
    　
  7. Audits and Vulnerability Assessments
    Regular internal and external audits, vulnerability scans, and follow-up improvements.
    　

Information Security Committee Structure

Scroll Top