Climate Change

Cybersecurity

In an age where data breaches and cyber incidents can have far-reaching consequences, including financial losses, reputational damage, and legal liabilities, a well-developed strategy is essential to proactively address these risks and ensure the continuity of business operations amid evolving cyber threats.

To ensure a secure online environment, we launched a mandatory online training program for all staff, covering essential topics such as phishing attacks, password security, data protection, social engineering, and best practices for secure online behavior.

Our Cybersecurity Strategy:

Compliance

Imposing stringent requirements on information technology service providers to comply with our cybersecurity standards and regulations of data protection;
Setting out clear policies and ensuring internal compliance.

Precaution

Establishing a management system to identify, analyze, and address the risks;
Upgrading and replacing application systems, system software and hardware in a timely manner to phase out outdated and unsupportedtechnologies;
Assessing system capabilities and implementing appropriate measuresand control procedures to mitigate the cybersecurity risks associated with remote access and the risk of unauthorized access and leakage of critical or sensitive data;
Testing and evaluating the safety of adopting any new technologies by internal and external technical experts.

Monitoring

Conducting regular assessments to identifythreats and vulnerabilities, and address them efficiently;
Implementing a clear escalation process to address suspicious IT issues and problems;
Preparing for Business Continuity Plans and disaster recovery procedures in case of systems failure to minimize the impacts.

Education

Providing adequate training to all employees and elevating awareness and competence on cybersecurity.

Supply Chain Management

In addition to a clearly defined internal governance and management structure, it is also crucial to extend oversight to our suppliers across all business units with our Supplier Code of Conduct, which sets out the standard of ethical conduct that our suppliers (including their subcontractors and agents) should comply with, covering areas such as environmental protection, labor rights and interests, intellectual property rights, and privacy protection. We regularly review and enhance our supplier engagement policies, strategies, compliance monitoring, and performance evaluation.

Supplier Prequalification

In the initial stage of supplier prequalification, a thorough set of controls is put in place to assess the suitability and reliability of potential suppliers. These controls include basic checks on a supplier’s competence, financial stability, technical capability, resource availability, track record, permits, licenses, and certifications. Additionally, we evaluate corporate governance by searching if any recent regulatory and ESG non-compliances, and significant adverse media coverage. To ensure our evaluations are based on accurate and comprehensive facts, we ask suppliers to provide proof, conduct interviews and site inspections. On top of internal control, we seek external consultant assessment when necessary to minimize blind spots in conducting critical decisions.

In the second stage, major ESG risks and corresponding controls are identified in the supply chain regarding our diverse business activities covering construction, leasing, customer service, food & beverage, retail, and sea transportation.

	Key Risks	Control in Response to the Risks
Environment	Pollutions, Resources Sustainability	Pollutions, Resources Sustainability
Social	Occupational Health and Safety (OHS), Customer Health and Safety	Personal protective equipment provision Qualified with international standards-ISO / Hazard Analysis Critical Control Point (HACCP)
Governance	Bribery and Corruption, Cybersecurity, Conflict of Interest, Anti-competition	Strict adherence to anti-corruption policy, providing anti-corruption training Reviewing the cybersecurity level of the services provided by related suppliers Anti-competition training for staff and clauses being introduced into the contracts Whistleblowing system in place

Continuous Performance Review

Performance monitoring and evaluation are in place to push the continuous improvements of our suppliers. Key performance indicators (KPIs) are tracked to assess timeliness, work quality, and environmental and safety standards. Feedback from on-site employees and end-users is gathered to evaluate satisfaction levels and identify areas for enhancement. Regular audits are conducted to ensure compliance with the Group’s standards, with a focus on quality assurance, environmental impact, and labor practices.

In case of any non-compliance, violations or less than satisfactory performance, corrective action plans are issued for suppliers to follow up. In severe or repeated cases, contracts are subject to termination.

Sustainability

Managing Sustainability