To enable Alucon Public Company Limited (the Company) to effectively manage cybersecurity and cyber risk in accordance with international best practices, and to prevent cyber threats, attacks, information system damage, and cyber espionage, the Company hereby declares its Cybersecurity Policy.

The key points are as follows:

1. Establish a Cybersecurity Task Force, assigning the IT Department to be responsible for cybersecurity management and serve as the primary unit in charge of cybersecurity.

2. Implement cyber risk management by assessing threats, vulnerabilities, likelihoods, and impacts on the business. The risk management must align with the organization-wide risk management framework. The scope of cybersecurity risk management includes all organizational assets and personnel, using a risk register and quality management system risk assessment forms.

3. Conduct communication and training programs to raise awareness, responsibility, and understanding of cybersecurity among employees. This will be carried out at least once per year through policies related to computer system usage and internet connectivity.

4. Install protective and detection systems for cybersecurity, covering the company’s information systems, including firewalls and antivirus software. The responsible unit must monitor threats and report cybersecurity threat information to the department manager at least once per quarter.

5. Prepare recovery and contingency plans (Disaster Recovery Plan – DRP) in the event of an incident or emergency to reduce impacts on critical business processes. This should be done at least once per year.