Data and Cybersecurity
Importance and Mission
Currently, there is an adaptation into a society transitioning through IT and entering the digital economy era, where operations are efficiently driven by increased technology usage. In addition to convenience and speed, the Company continues to face cyber threats to various critical data, including operational systems. More importantly, data breaches or data loss, whether involving business information, personal data, or stakeholder information, caused by negligence or cyberattacks, can impact operational security and extend to corporate reputation and image if the data is misused, potentially causing severe damage to data owners. Therefore, effective data management leads to transparency and builds trust and confidence in working with the organization.
Goals and Performance
Goals
- No complaints regarding personal data breaches
- No cases of violations or leakage of business data 0 cases.
Performance
No complaints regarding personal data breaches.
No incidents of data leakage or unauthorized disclosure/use.
Management Approach
The Company has established an IT Security Policy to support and promote business operations, and security practices for IT security, including computer systems, networks, software, critical systems, and data, to protect against potential cyber threats. This ensures secure, continuous, and efficient IT operations and communications. This policy refers to recognized cybersecurity standards and regulations, covering damage prevention for IT systems, incident and emergency response, and mitigation of operational and financial impacts on the Company. Additionally, the Company emphasizes awareness and understanding by communicating this policy to the Board of Directors, executives, and employees at all levels. The policy is subject to annual review, at least once per year.
IT Security Management
The Company recognizes the importance of maintaining IT security and the use of IT and communication systems within the Company, with the objective of preserving confidentiality, integrity, and availability of information systems, as well as other attributes, including authenticity, accountability, non-repudiation, and reliability. The Company has established information security guidelines as a framework for IT and cybersecurity management, which helps protect the organization and ensure stable operations. The Company’s security practices consist of a total of nine categories, as detailed below.
- Maintaining security of access and controlling the usage of information and IT and communication systems.
- Managing the information center by implementing physical entry controls for the information center.
- Maintaining security in computer usage.
- Maintaining security in internet usage and email communication.
- Maintaining security in asset and network management.
- Controlling security for operational activities.
- Maintaining security in data backup and recovery.
- Assessing risks in IT and communication systems.
- Raising awareness of IT security
Preventive Measures for Cyber Threat Emergencies
The Company has established measures and processes to prevent cyberattacks and IT security threats, ensuring cybersecurity is maintained. These measures are outlined in the Company’s Information Security Guidelines, with details as follows:
- Implementing a structured data storage and backup system based on data types, including operating system software, application software, and at least one set of commands and data, stored separately in different locations to ensure security and continuous usability.
- Assigning responsible personnel for data backup, ensuring accurate and complete verification of data at least once per year.
- Establishing a backup frequency schedule and performing data backups according to the defined schedule (at least once per year).
- Preparing an emergency preparedness plan to restore the system within the specified timeframe, including creating a disaster recovery plan according to information security guidelines and reviewing the recovery plan at least once per year.
- Creating an emergency response plan for situations where electronic systems are non-operational to ensure business continuity.
Internal Communication for Awareness Raising
The Company has arranged for raising awareness regarding IT security, by specifying the dissemination of information and training for employees within the Company to understand and not violate the Computer-Related Crime Act and various relevant IT regulations. Additionally, to raise awareness about responsibility in maintaining IT security, the Company has arranged the IT-related training courses within the Intranet system, consisting of the Cybersecurity for IT and IT Policy and Cybersecurity. Employees can access these courses for self-learning, covering key topics as outlined below.
- What is Cyber Security
- Fundamentals of Cybersecurity
- Types of Cybersecurity Threats
- IT Security Policies
- Cybersecurity Awareness
Personal Data Protection of Stakeholders
The Company recognizes the importance of personal data protection in accordance with the Personal Data Protection Act B.E. 2562 (2019). Whether the data subjects are customers, supplies, contractors, service providers, job applicants, employees, interns, visitors, directors, or investors, the Company has established a Personal Data Protection Policy under the Personal Data Protection Act B.E. 2562 (2019). This policy serves as a guideline for departments and employees involved in personal data management, ensuring compliance with legal requirements. Furthermore, the Company acknowledges the impact of personal data breaches and has implemented various measures to protect data subjects. These measures ensure that personal data is handled correctly from the stages of collection, storage, use, disclosure, and destruction, all within the scope of the Company’s business objectives.
The Company has established a Corporate Governance Working Team on Personal Data Protection, responsible for providing guidance to personal data controllers, processors, as well as employees or contractors involved in personal data processing. This includes ensuring compliance with the Personal Data Protection Act and monitoring the operations related to the collection, use, and disclosure of personal data. Additionally, the working team coordinates and collaborates in cases involving issues with personal data collection, usage, or disclosure. Importantly, it is responsible for maintaining the confidentiality of any personal data that it becomes aware of or acquires in the course of its duties under the Personal Data Protection Act. Furthermore, the Company conducts an annual review of the Personal Data Protection Act B.E. 2562 (2019) to ensure ongoing compliance and up-to-date understanding of the law.