1.1 Risk Identification
All departments are responsible for identifying potential risks and factors that may cause operational disruptions, such as machinery breakdowns, computer system failures, or shortages of raw materials.

1.2 Determination of Severity Levels
The Company defines acceptable levels of impact as well as critical thresholds that require immediate action, ensuring that potential incidents do not significantly affect overall business operations.

1.3 Risk Monitoring and Early Warning System
Monitoring mechanisms and early warning indicators are established to detect potential issues in a timely manner, allowing preventive actions to be taken before problems escalate.

1.4 Emergency Response Procedures
Each department maintains documented procedures outlining clear roles and responsibilities, along with guidelines for responding to various types of emergency situations.

2.1 Emergency Communication Channels
Emergency notification procedures are established, including contact details of responsible personnel and relevant external agencies such as fire departments, rescue services, or emergency maintenance providers.

2.2 Recovery Time Objectives
Clear targets are defined regarding the timeframe within which each department must restore operations, ensuring that recovery objectives can be achieved efficiently.

2.3 Backup Resources Preparation
Backup resources, including equipment, data, and alternative work locations, are prepared to ensure immediate availability when unexpected events occur.

2.4 Backup Systems and Alternative Processes
In the event that primary systems are unavailable, the Company implements backup systems or manual procedures as specified in the operational guidelines to minimize disruption to business operations.

3.1 Emergency Simulation and Drills
The Company conducts emergency response drills at least once a year to ensure employee preparedness and to review the effectiveness of the established plans.

3.2 Incident Documentation and Learning
Incidents that may disrupt operations, including near-miss events, are analyzed to identify preventive measures and improve operational processes in the future.

3.3 Management Reporting
Progress and outcomes of risk management activities are regularly reported to management to support decision-making and strengthen long-term organizational resilience.

3.4 System and Data Recovery Testing
The Company conducts regular testing of system recovery processes and data restoration from backups to ensure that operations can be restored within the defined recovery timeframe when an actual incident occurs.

The Company strictly enforces its business ethics policies, covering anti-corruption and anti-bribery measures, anti-money laundering practices, fair business conduct, and compliance with all applicable laws and regulations in the countries where the Company operates.

Appropriate internal control systems have been established, along with independent and confidential grievance mechanisms. In addition, regular employee training programs are conducted to promote an organizational culture grounded in integrity, accountability, and transparency.

The Company respects and supports internationally recognized human rights principles and implements Human Rights Due Diligence across its supply chain.

Key commitments include:

• Prohibition of child labor and forced labor
• Fair and transparent employment practices
• Provision of wages and benefits in compliance with legal and industry standards
• Appropriate working hours
• Non-discrimination and promotion of workplace equality
• Establishment of anonymous grievance mechanisms with protection against retaliation

The Company is committed to creating a safe working environment that respects human dignity and promotes the well-being and quality of life of employees at all levels.

The Company conducts its business with consideration for social and environmental impacts throughout the product life cycle, from raw material sourcing and manufacturing to product delivery.

Key practices include:

• Supplier selection and evaluation based on responsible sourcing principles
• Traceability of raw material origins
• Waste management and pollution control
• Safe chemical management
• Efficient use of resources
• Assessment and reduction of greenhouse gas emissions
• Sustainable management of water and natural resources

The Company continuously monitors and evaluates its environmental and social performance in order to improve operational efficiency and minimize long-term impacts.

The Company has developed a management system aligned with RJC requirements by establishing clear roles and responsibilities, documented policies and procedures, and robust internal control mechanisms supported by regular internal audits.

This framework includes:

• Oversight by senior management
• Periodic management reviews
• Documented systems and recordkeeping that enable traceability
• Appropriate disclosure of relevant information to stakeholders

These practices help ensure that the Company’s operations remain transparent, fair, and consistently aligned with international standards.

The Company has established strict supply chain monitoring and control measures to ensure that raw materials used in production comply with responsible sourcing principles.

The Company operates under a responsible sourcing framework to ensure that raw materials:

• Do not contribute to conflict financing, with risk assessments conducted on sources of origin and avoidance of sourcing from Conflict-Affected and High-Risk Areas (CAHRA) without appropriate due diligence
• Are not associated with human rights violations, through the implementation of Human Rights Due Diligence processes and ethical requirements for business partners
• Are not linked to money laundering or illegal activities, through strict Know Your Counterparty (KYC) procedures and Anti-Money Laundering (AML) measures
• Are transparent and traceable, supported by documentation systems and tracking processes from source to finished product

These practices demonstrate the Company’s commitment to ethical, transparent, and socially responsible business operations while strengthening trust among customers, business partners, and stakeholders worldwide.

The Company continuously promotes cyber security awareness among employees through regular communication and knowledge sharing on common cyber threats, such as phishing and malware. Employees are also provided with guidance on best practices for protecting critical information, including personal data, passwords, and business-sensitive information.

In addition, the Company organizes training programs and cyber security readiness exercises on a periodic basis to strengthen employees’ understanding and reduce risks associated with the use of information systems.

The Company implements technological measures to prevent and monitor cyber threats. Network and information systems are protected through security solutions such as firewalls and intrusion prevention systems, utilizing security equipment from Fortinet to control and prevent unauthorized access. System logs and operational status are regularly monitored to detect potential irregularities.

Furthermore, security patches and software are continuously updated to the latest versions. The Company also conducts cyber security risk assessments at least once a year and enforces access control measures to ensure that system and data access rights are granted in accordance with users’ roles and responsibilities.

The Company has established a Cyber Security Incident Response Plan to ensure effective response to potential incidents. The plan covers procedures for incident notification, damage containment, system recovery, and incident reporting. Currently, the Company has implemented a Disaster Recovery Plan (DRP) to support the recovery of information systems in emergency situations.

Roles and responsibilities, as well as incident reporting channels, have been clearly defined. All cyber security incidents are recorded, analyzed, and reported accordingly. In addition, cyber incident response drills are conducted and the incident response plan is reviewed at least once a year to ensure it remains up to date and responsive to evolving risks.

These measures strengthen the Company’s information security management framework, support stable business operations, and enhance stakeholder confidence over the long term.