Information Security | ACER ESG

Information Security

Information Security

Home
ESG Governance
Information Security and Privacy Protection
Information Security

Information Security Policy

In pursuit of sustainable operation and the protection of our customers’ trust in us, Acer began implementing an information security management system in 2019. At the foundation of this ISMS is Acer’s information security policy, helping ensure the security of information assets and the continuity of information services, thus mitigating the threat from and impact of information security incidents.

This policy applies when accessing Acer IT’s information assets, IT systems, and infrastructure. It applies to all executives and employees of Acer IT, including contractors, consultants, temporary staff, trainees, and any other third parties working for Acer IT (referred to hereafter as “staff”).

  • Ensure that Acer’s information assets are protected from any external interference, destruction, attacks, or any impact from other destructive or negative behaviors.
  • Ensure Acer is compliant with relevant laws.
  • Ensure the continuity of information services.

The policy framework follows and is based on the following regulations: 

  • Trade secrets laws, e.g., the US Defend Trade Secrets Act (DTSA), Taiwan Trade Secrets Acts, and similar laws in other jurisdictions. 

  • Privacy protection laws, e.g., the EU General Data Protection Regulation (GDPR), Taiwan Personal Information Protection Act, and similar laws in other jurisdictions. 

This policy is reexamined at least once a year to check for legal compliance with the latest technology and business developments.

Information Security Risk Management Framework

 

Acer Corporation established the Risk Management Executive Committee in 2022, with the Chief Information Security Officer (CISO) serving as one of its members. In the same year, Connie Lee was appointed as the CISO. The CISO is

responsible for formulating and executing the company's information security and protection policies, as well as managing related risks, covering both IT system security and product information security.

To further strengthen the Group's information security risk management, Acer Corporation established the Information Security Governance Committee in 2023, led by the CISO and coordinated by the Acer Information and Network Security Center. Committee members include the heads of Acer's IT product lines and the general managers of subsidiary companies within the Group. Dedicated working groups have been established under the committee, responsible for developing information security and protection policies and conducting risk assessments. The effectiveness of the Group's information security governance, as well as security-related issues and strategic directions, are reported quarterly to the Chairman of the Board. An annual report on information security risk governance is also submitted to the Board of Directors. 


Please refer to : Acer Risk Management Organizational Structure Chart for information regarding the Acer Group's information security organizational chart。

 

Information Security Governance

 

As a global brand, Acer considers maintaining information security immensely important, especially with regard to earning and keeping the trust of those investing in the brand, customers, and other interested stakeholders. We continue to work to improve global information security organization and policy, and to coordinate work on the various aspects of information security management systems, to ensure that the Group’s information assets comply with relevant laws, regulations, and standards. We also strive to set out the security control measures necessary to protect the Group’s information systems and services. 

 

We have established a global information security management organization, and in accordance with the organizational structure, powers, and responsibilities, jointly worked to maintain the system’s sound operation, achieving our goal of stronger information security management. The head of ISMS is the Head of the Global IT and assigns a co-convenor. The head of each division is a member of the information security management organization and assigns representatives to establish the Information Security Management Team, the Information Security Establishment Team and the Information Security Incident Response Team. The information security internal audit team is staffed by the auditing office, and the support team draws from Human Resources, General Affairs, Marketing, Legal Affairs and Finance Departments. 

 

Since October 2021, Acer has launched the Global Re-architect project, spending 2 years to re-examine information

security and infrastructure across the globe. Each year, we undergo reviews and revalidation by third-party certification body BSI to ensure the continued effectiveness of our ISO 27001 certification. Acer maintains mechanisms for planning, establishing, executing, and

monitoring to safeguard the confidentiality, integrity, and availability of information assets.

In 2024, Acer Headquarters' Cybersecurity Center was reorganized, with the Cybersecurity Department promoted to a

Cybersecurity Center. Additionally, adjustments were made to the newly implemented control measures in accordance with the ISO 27001:2022 version. To further enhance information security management, Acer Headquarters' Cybersecurity Center organized the 2024 Acer Group Cybersecurity Workshop.

Through this workshop, Acer Headquarters' Cybersecurity Center shared cybersecurity experiences with the subsidiaries,

strengthening connections between the group and the headquarters to achieve an effective collaborative defense

against cyber threats.

 

Download the certificate

Information Security Management Focuses and Achievements

 

  • In compliance with the release of the new version of ISO 27001: 2022, updated the necessary documents of the Information Security Management System (ISMS) to ensure compliance with the requirements.
  • Expanded the scope of the company's information security risk control from IT systems to IT products.
  • Strengthened network firewall and network control to prevent malware from spreading horizontally across the network through network architecture micro-segmentation.
  • Introduced a multi-level control mechanism for privileged accounts to prevent leakage of privileges.
  • Introduced endpoint management mechanism to manage, protect and deploy enterprise resources and applications.
  • Built cloud information security automation control framework.
  • Through quarterly meetings of the cybersecurity working group, we engaged IT personnel from subsidiaries to enhance and implement information security measures. To establish an accountability framework.
  • Standardize specifications for information outsourcing and the information services launch processes to reduce information security risks.

Implement information security management and cultivate a strong security culture

Acer is committed to implementing information security management and cultivating a deep understanding of the purpose behind security activities. To enhance the awareness of information personnel and ensure that frontline employees executing security activities are well-informed, Acer organizes the annual ISMS Workshop and security activity briefings. This ensures that they have the knowledge to act accordingly and continuously provide recommendations to the management departments for optimizing future security implementation plans. This creates a positive cycle of security and fosters a culture of information security within the organization.

 

Information Security Training

 

Acer Corporation has implemented personnel education and training programs to strengthen information protection mechanisms and information security management. In the second quarter of 2024, all IT personnel in the global IT department successfully completed security education and training. Furthermore, comprehensive security education and training sessions were conducted for all employees across all departments worldwide, addressing important topics such as passwords, phishing, remote work, ransomware, business email attacks, and the reporting procedures for phishing incidents.

In 2024, the Acer Headquarters Cybersecurity Center provided cybersecurity awareness training to a total of 6,148 Acer employees worldwide, including those from unlisted subsidiaries. Of these, 5,728 employees successfully completed the training, resulting in a completion rate of approximately 93%. The standard for completion required passing a post-training assessment, with all test scores needing to reach 100%.

ISMS Workshop

Besides the existing ISA training, to implement the key information security work of Acer’s IT personnel, IT ISO & ITSM Office (ISO Office) of Acer Global IT regularly organizes ISMS workshops of information system account inventory, business impact analysis, objective effectiveness measurement, risk assessment and other key ISMS work items. ISO Office publishes ISMS Workshop presentation slides, FAQs, and teaching video materials to ensure information security work can keep pace with the times.

Global Employees

e-Learning

Results and Statistics

Feedback and Action Plan

Information Security Drill

To ensure staff can respond promptly to and handle issues resulting from the impact of major system failures, negative human factors, or natural disasters, Acer holds annual vulnerability scans, penetration tests, and business continuity drills to examine the risk coefficient of all processes and establish recovery plans that strengthen the Company’s emergency response capability and tolerance against cyber attacks. The details of this are as below:     

Acer regularly conducts annual disaster response drills for fire, power outage, earthquake, etc. In addition, Acer also conducts quarterly drills for the core systems (including the ERP system, order management system, and accounting system) and more than 100 sub-systems to implement different levels of recovery control measures according to the plan, so as to minimize the impact of a disaster.

Vulnerability scans

Acer annually examines OS and network equipment security issues to discover vulnerabilities in system operations in time via vulnerability scans, implementing follow-up fixes to prevent vulnerability to attacks.

Penetration tests

Acer commissions a third-party cyber security institution to implement drills. The penetration test team tries to break through network or system defenses with minimal information, such as searching the issues of web page programs or operating systems, to obtain further permissions or access unauthorized data. From the results of these tests, Acer is able to understand security blind spots in the system building or programming process and thus take action to correct or prevent them, enhancing the security level of the enterprise network and reducing security risk.

Business continuity drills

Acer has set out the Information Security Continuity Management Guidelines to provide guidance to all units in Acer IT in implementing business continuity strategies during adverse situations. Acer follows ISO 27001 and ISMS to routinely execute drills to examine the effectiveness of business continuity drills. Meanwhile, the Company also evaluates the index of RTO, RPO, and service-level functions of all due systems to implement resource integration and business continuity, ensuring the effectiveness of systems and protecting the best interests of our customers and stakeholders.

2025 Information Security Management Focus

 

  • Achieved ISO 27001:2022 transition certification in March 2025; in September, passed re-verification by third-party information security certification company BSI.
  • The Group Information Security Governance Committee shall convene quarterly to improve information security.
  • Achieve a 90% completion rate for cybersecurity awareness education and training for employees worldwide.
  • Achieve a 100% completion rate for cybersecurity training among colleagues in the IT department worldwide.
  • The average score for the 2025 Scorecard exceeded 90.
  • Operations continue to conduct mock drills that simulate both cloud and on-premises scenarios.
  • Strengthen information security control policies, processes and frameworks, and establish standards to identify information security maturity.
  • Strengthen network firewall and network control to prevent malware from spreading horizontally across the network through network architecture micro-segmentation.
  • Implement a multi-level control mechanism for privileged accounts to prevent leakage of privileges.
  • Implement endpoint management mechanism to manage, protect and deploy enterprise resources and applications.
  • Strengthen information protection mechanisms and data leakage prevention controls, continuously enhancing the capability to safeguard confidential information. 
  • Perform regular information security drills and continuously optimize the mechanism.
  • Build cloud information security automation control framework.
  • Enhance backup effectiveness and provide a recovery solution that can be rebuilt quickly. 

Evaluation Mechanism

ISO 27001 third-party audits are conducted annually, with regular internal and external ISMS audits following the PDCA continuous improvement cycle. In 2024, four audits identified 59 findings: 14 non-conformities and 45 recommendations. (Please refer to the following figure) By December 31, 2024, 80% (47 items) have been resolved. The organization is implementing automation tools to improve information security management, with remaining issues planned for resolution in 2025. 

 

  • Regularly implement information security drills, stress tests, and data recovery drills during non-audit periods
  • Regularly conduct: personal data inventory and risk assessment and handling of personal data for equipment security control

  • Occasionally conduct: Training of personal data processing managers, implementation of data security test drills, and supervision of outsourced vendors to comply with personal data protection regulations.

      

2025 Information Security Events

 

  • 2023/09/14 The audit objectives have been achieved and the certificate scope remains appropriate. Acer’s ISO 27001: 2013 remains valid.  
  • 2024/03/08 The audit objectives have been achieved and the certificate scope remains appropriate. Acer’s ISO 27001: 2013 remains valid.
  • 2025/03/12 Acer successfully completed the audit process, achieving the transition from ISO 27001:2013 to the updated ISO 27001:2022 standard. The audit objectives were fully met, and the certification under the new version is now in effect
  •  

Download the certificate