Risk management and strategy

Cybersecurity risk management is an important part of our risk management system. We have established clear systems and internal policies to strengthen the identification and control of cybersecurity risks. In terms of risk identification, we identify potential cybersecurity risks by deploying monitoring logs of various security devices and through our self-built alarm platform. In addition, we have established and maintained communication channels with third-party security risk monitoring platforms and built our own cybersecurity emergency response center to capture cybersecurity threats from external sources. In terms of risk assessment and management, we have established a hierarchical management process for dealing with cybersecurity threats. When we receive an internal alert or a verified external risk notification that our cybersecurity operations team determines to be non-high-risk, we will directly arrange for manual handling. If the risk is determined to be high-risk, the head of our cybersecurity operations team will report to our chief technology officer, such that our chief technology officer and relevant personnel will jointly assess the threat risk level, and simultaneously arrange for manual handling. If such risk is further determined to be a significant cybersecurity incident, it will then be escalated to our dedicated team for cybersecurity incidents. Upon receiving the relevant information about the cybersecurity incident, our dedicated team will inform our chief executive officer and chairman of the board of directors of the relevant events that have taken place, according to the prescribed cybersecurity risk preferences. In the event of a major cybersecurity incident, we will initiate emergency plans in a timely manner under the guidance of our management team, develop and deploy special response plans, and carry out emergency recovery, attack source tracing, remedial measures and other response actions. At the same time, our management will closely follow the development of the situation, examine the scope of impact, and report the incident and disposition to the higher regulatory bodies in a timely manner.

We have also established a cybersecurity management mechanism for third-party IT service providers. Prior to granting access to suppliers, we investigate and evaluate our third-party IT service providers’ IT-related qualification and capabilities and data security capabilities. IT service providers that do not possess the appropriate capabilities or do not meet the relevant regulatory requirements are prohibited from being shortlisted. After establishing cooperation with them, we conduct re-evaluations of our third-party IT service providers annually, and will press for improvements or discontinue collaboration subject to the results of the evaluations.

As of the date of this report, we have not identified any cybersecurity risks that have or may have a material impact on our company.

Board’s role. Our board of directors acknowledges cybersecurity risk as a strategic concern vital to our operational continuity. Our board of directors incorporated cybersecurity awareness into our decision-making process and established a protocol for our management to report cybersecurity risks to the board of directors. Our board of directors delegates the primary responsibility for overseeing cybersecurity risks to our chairman of the board of directors, with our management responsible for the day-to-day management of cybersecurity risks. Our chairman of the board of directors receives quarterly updates from our management on the latest information regarding the management of our cybersecurity, and our board of directors will receive regular updates on relevant topics. In order to perform its supervisory duties, our board of directors, in particular our chairman of the board of directors who is responsible for receiving reports from our management on cybersecurity risks, proactively learns about cybersecurity expertise, and keeps itself up-to-date with changing laws, regulations and regulatory requirements. In addition, our board of directors pays close attention to the requirements imposed by regulatory authorities regarding the disclosure of information on cybersecurity of listed companies, promptly approves our internal disclosure control policy as updated in accordance with the regulatory requirements in a timely manner and maintains supervision over the disclosure of the cybersecurity-related sections of our periodic reports.