信息安全管理

File Description Information Safety

Management Policy

JY/WI-AD01101 页码Page：1/15

1.0目的Purpose

规范公司信息处理程序，确保公司各种信息访问和交流的安全性。

To standardize information processing procedures and ensure the safety of access to various information and communications of the Company.

2.0范围Scope

适合公司各类信息载体（含电子文档，纸质文档）。

Various types of information carriers of the Company (including electronic files and paper files).

3.0权限Scope of Authority

3.1总经理General Manager

3.1.1批准公司信息安全管理程序；

3.1.1Reviewing and approving the Company’s information safety management policy;

3.1.2为公司落实信息安全管理程序提供资源保障；

3.1.2 Providing resources for the implementation of the Company’s information safety

management policy;

3.1.3批准公司核心员工和敏感电脑。

3.1.3 Approving the appointment of key employees and allocation of sensitive computers.

3.2管理者代表Management Representative

审核信息安全管理程序，协调各部门认真执行该程序。

Reviewing the information safety management policy and coordinate the implementation of the policy in individual departments.

3.3人事行政部Personnel & Administration Department

3.3.1制定并落实信息安全管理程序；

3.3.1 Formulating and implementing the Company’s information safety management policy;

3.3.2对员工进行安全保密法规教育，增强员工信息安全意识，组织核心岗位员工签订保密

协议；

3.3.2 Educating and training employees in terms of the confidentiality-related regulations,

enhancing the employee awareness of information safety and signing confidentiality agreement with employees working on key posts;

3.3.3对信息安全管理程序落实情况进行检查并进行记录，提出奖罚意见。

3.3.3 Supervising the implementation of the information safety policy, keeping records of the

implementation and proposing punishment recommendations.

3.4各部门Individual Departments

督促员工执行公司信息安全管理程序，确保公司信息安全。

3.4 Supervising the implementation of the Company’s information safety management policy and

ensure the information safety of the Company.

4.0定义Definitions

4.1信息：信息是事物现象及其属性标识的集合；

4.1 Information: Information is a collection of a phenomenon and its property identifiers;

4.2信息载体：分为计算机电子文档，文件资料纸质文档；

4.2 Information carrier: Electronic files and paper files;

4.3企业秘密：不为公众所知晓，能为权利人带来经济利益和竞争优势，具有实用性并经权

利人采取保密措施的信息。其范围为公司发展规划，重大决策和投资，月季年度财务信息，对外商务谈判信息，各种对外合同协议，公司总经理办公会会议记录，员工人事档案；公司产品及模具设计图纸，制造工艺，新技术新产品研发资料；原材料采购信息，成品及半成品检测报告；公司客户相关信息，客户所提供的技术和产品资料等；

4.3 Enterprise secrets: Information of practicality not known to the public that may bring

economic benefits and competitive advantages and for which the owner takes security measures. The scope of enterprise secrets covers the development plans, major decision and investment, monthly, quarterly and annual financial statements, external business negotiation,

external contractual agreements, minutes of the General Manager's meetings, personnel files, products and mold design drawings, manufacturing processes, new technology and new product development, raw material procurement, test reports and semi-finished products, customer information, technical and product information supplied by customers, etc;

4.4保密文件：含有企业秘密的信息；

4.4 Confidential file: A file that contains enterprise secrets;

4.5敏感电脑：装有公司企业秘密的电脑；

4.5 Sensitive computer: A computer that contains enterprise secrets;

4.6核心员工：主管以上员工、人事行政部文员和出纳、工程部、市场部、物控部所有员工、

总经理确定的员工。

4.6 Key employees: Employees who holds an office of the department director or above, clerks and

cashiers of the Personnel and Administration Department, all staff members of the Engineering Department, the Market Department, the Material Control Department and other employees the General Manager considers as key employees.

5.0程序Procedures

5.1公司计算机网络信息安全管理

5.1 Information safety management for the computer network of the Company

5.1.1 为确保公司计算机网络的信息安全，特设网络管理员岗位，其职责为：

5.1.1 A network administrator is appointed to for the information safety management for the

computer network of the Company with the following responsibilities:

5.1.1.1制订落实计算机网络信息安全管理制度；

5.1.1.1 Formulating and implementing the information safety management policy for the

computer network of the Company;

5.1.1.2每季对公司电脑安全使用情况进行检查，检查项目见（计算机健康巡检记录表）

并进行记录；

5.1.1.2 Inspecting the safe use of computers of the Company on a quarterly basis and keeping

a record of the inspection (Refer to the Computer Health Inspection Record);

5.1.1.3负责联系对电脑的定期保养和维护，全程监控敏感电脑的维护；

5.1.1.3 Being responsible for the periodical maintenance of computers of the Company and

fully controlling the maintenance of sensitive computers;

5.1.1.4每季度更新公司服务器密码（8位数以上且数字与字母混编），并对公司计算机

网络做好系统备份，确保系统安全运行；

5.1.1.4 Updating the server password (8 digits or more and mixed with letters) and backing up

the data on the computer network, ensuring the safe operation of the system;

5.1.1.5处理公司计算机网络重大事故并对责任人提出绩效扣分意见等。

5.1.5 Addressing serious accidents of the computer network of the Company and proposing

performance bonus deduction recommendations as a means of inflicting punishment on

the persons responsible for the accidents;

5.1.2 公司计算机网络信息安全管理制度

5.1.2 Information safety management policy for the computer network of the Company

5.1.2.1公司员工计算机网络系统和公司服务器由网络管理员统一管理。服务器机柜只能

由网络管理员来开启维护，除公司副总以上不得在未经网络管理员许可的情况下打

开服务器机柜，对服务器进行操作；

5.1.2.1 The employees’ computer network and the server of the Company shall be collectively

managed by the Network Administrator. The server rack shall be opened for

maintenance work by the Network Administrators and no staff member except a Deputy

General Manager or an officer of a higher rank may open the server rack for operation

without permission from the Network Administrator;

5.1.2.2为保证公司信息安全和公司网络系统的整体维护，对公司核心信息数据设备（文

件服务器与监控服务器）的操作密码由网络管理员统一管理。密码管理规定：分为管理员密码（可以对服务器执行所有操作）和客户端(只能进行查询回放等基本操作而不能对数据和服务器做更改复制删除等高级操作)登录密码。管理员密码设置须在八位数以上且由数字和英文字母以及特殊符号混编，服务器管理员密码每季度更换一次，由网络管理员设置好后，汇报给公司副总以上领导。密码知情人包括副总以上指定人员。严禁通过各种黑客行为和非法手段登录访问公司服务器，植入病毒、破坏系统、窃取和修改数据；

5.1.2.2 To ensure the safety of the information of the Company, the operating password for the

core data equipment (file server and monitoring server) shall be collectively managed by the Network Administrator. Two types of passwords shall be set, one for the administrator (for all operations on the servers) and client login password (for inquiry and other basic operation but not for updating, copying or deleting data or other operation on the server). The administrator password shall be composed of eight characters composed of numbers, letters and special symbols. The administrator password for the server shall be updated on a quarterly basis by the Network Administrator and reported to a Deputy General Manager or an officer of a higher rank.

The password shall be accessible to a Deputy General Manager or an officer of a higher rank only. It is strictly prohibited to access the server of the Company, implant viruses, destroy the system and steal or modify data in the server system by any hacking and illegal means.

5.1.2.3 公司对计算机保密文件实行统一管理：公司计算机保密文件统一存储在公司文件

服务器上，对于员工个人计算机上的公司保密文件要全部转移存储到文件服务器上的指定文件夹内，并由文件管理专员统一管理，只有授权用户才有权访问。严禁通过各种黑客行为和非法手段登录访问公司服务器，植入病毒、破坏系统、窃取和修改数据。服务器上的文件要做好严格的数据安全备份，确保数据的连续完整不丢失；

5.1.2.3 Computer-related confidential files shall be collectively managed: The files shall be

collectively stored on the file server of the Company; all confidential files used on computers of individual employees shall be transferred to the designated folder on the file server and collectively administrated by the Network Administrator, accessible only to authorized users. It is strictly prohibited to access the server of the Company, implant viruses, destroy the system and steal or modify data in the server system by any hacking and illegal means. Files on the server shall be backed up in a most strict manner to ensure the completeness and prevent loss;

5.1.2.4为方便有效准确的对公司计算机资源做统一管理，网络管理员对公司局域网内计

算机（包括便携移动计算机）实行员工工号对应制（见“佳一计算机及附属设备配置信息详单”）；

5.1.2.4 To facilitate the effective and accurate management of company computer resources,

the Network Administrator shall appoint a designated number for each of the computers (including portable computers) within the LAN of the Company (Refer to “List of Setup Information for Computers and Accessories of Jiayi Company);

5.1.2.5 为了更好的分配公司计算机资源和正确高效的对内部局域网计算机用户的管理，

网络管理员统一公司计算机命名规则和IP地址分配以及根据公司各部门来划分IP 网段，实行IP地址和计算机网卡物理地址绑定（见佳一计算机及附属设备配置信息详单），员工不得私自更改配置；

5.1.2.5 In order to better allocate computer resources of the Company and manage users

within the LAN of the Company efficiently, the Network Administrator shall adopt a consistent rule for the naming of the computers and the IP address assignment. Each individual department shall be assigned with a certain IP network segment and an IP address is physically attached to a network card (Refer to “List of Setup Information for Computers and Accessories of Jiayi Company) and employees are not allowed to change

it without permission;

5.1.2.6公司计算机只限本人使用，须设开机密码，无关人员禁止使用。开机密码须在六

位数以上且由数字和英文字母（区分大小写）混编，该密码须每三十天更新一次（系统已配置好，到期会自动弹出提示更改密码，请务必立即更改，并记牢，由于个人原因忘记密码自行承担后果）；

5.1.2.6 The computer allocated to each employee shall be used only by the appointed user

with a power-on password. The power-on password shall be of at least six characters made up of digits and English letters (case sensitive). The password shall be updated every thirty days (programmed to be automatically pop up a prompt for the user to update). Please remember the password and the user shall assume full responsibility if he/she forgets the password;

5.1.2.7员工携便携电脑或其他移动存储设备外出，所携装置不能带有公司保密文件，特

殊情况需向公司副总以上申请，批准后，由公司文件管理专员或网络管理员发放。

不允许通过因特网向外发送公司保密文件，特殊情况下须向公司副总或以上请示后，做好加密安全措施后才能发送；

5.1.2.7 No confidential file is allowed to be taken out in the portable computers or other

mobile storage devices. If special circumstances require such files to be taken out, approval shall be obtained from a Deputy General Manager or an officer of a higher rank and the file shall be obtained from the File Administrator or the Network Administrator of the Company. It is not allowed to transmit any confidential file externally through the Internet. If special circumstances require to do so, approval from a Deputy General Manager or an officer of a higher rank shall be obtained and the file shall be transmitted in a encrypted form;

5.1.2.8公司计算机及附属周边设备由公司网络管理员统一安排维护更新。由于计算机硬

件及其周边设备老化影响工作或因工作需要必须对硬件升级扩容更新的，以及需要更换打印耗材易耗品的，要首先提交申请，由网络管理员实际检测后交公司副总或以上人员审核，审核通过后由网络管理员统一更换；

5.1.2.8 The maintenance and update of the computers and peripherals shall be collectively

arranged by the Network Administrator. If the computer hardware and peripheral equipment are aged and prevent the normal work, if they are necessary to be updated or if it is necessary to replace printing supplies or other consumables, The user shall first apply to the Network Administrator to test, and an application shall be submitted to a Deputy General Manager or an officer of a higher rank. The update shall be done by the Network Administrator with approval.

5.1.2.9公司与客户来往邮件安全管理:对于邮件中的附件资料要做加密措施，而在因特网

上传输过程中的保障由邮箱服务商提供加密安全措施，确保公司与客户沟通邮件的安全性；

5.1.2.9 Management of emails between the Company and its customers: The file attached to

the email shall be encrypted and security measures provided by the email service provider shall be adopted to ensure the security of the file transmitted online between the Company and its customers;

5.1.2.10因特网访问权限：只允许各部门特定主机访问因特网，其他用户计算机实施与

因特网隔离，即只能访问公司内部网络，而不能上因特网；

5.1.2.10 Access to the internet: Only a designated host is allowed to access the internet while

users of other computers are restricted to the internal network;

5.1.2.11公司电脑只能安装统一规定的软件（见“桌面办公平台标准”），如有特殊情况需

要安装第三方软件的，需经公司副总或以上人员同意，由网络管理员检测后才能安

装；

5.1.2.11 All computers of the Company shall be equipped with appointed software (Refer to

Desktop Office Platform Standard); if it is necessary to install third-party software, such software shall be installed by the Network Administrator after testing, with approval from

a Deputy General Manager or an officer of a higher rank;

5.1.2.12未经公司许可，严禁在计算机上进行与工作无关的任何操作，个人办公计算机

及附属打印设备一经配置好，严禁私自打开机箱面板，如有特殊情况，需告知网络管理员，由网络管理员来操作；严禁私自改动计算机的软硬件配置，严禁私自更改操作系统设置，禁止私自转移个人主机附属打印设备到其他计算机，如因工作变化需要改动者，需报告网络管理员，由网络管理员进行统一安排，由于个人原因私自改动计算机设置导致影响工作的，自行承担后果；

5.1.2.12 Without permission from the management, no non-business operation may be done

on computers of the Company; once the computer and printing equipment are configured, the computer rack may not be opened without permission; if it is necessary to do so, the Network Administrator shall be informed and the operation shall be done by the Network Administrator; it is strictly prohibited to modify the configurations of the software and hardware of the computer and the OS setup without permission or connect a printer from one computer to another; if necessary, such modification or reconnection shall be done by the Network Administrator; employees shall be responsible for any consequences arising from unauthorized modification or reconnection;

5.1.2.13 禁止使用外来U盘、软盘、光盘等移动存储设备与公司计算机连接传输数据，

如有特殊情况，需请示公司副总以上批准，并经网络管理员进行检测杀毒后方能使用；

5.1.2.13 It is strictly prohibited to connect external U disks, floppy disks, CD-ROM or other

removable storage devices to the computer of the Company without permission; if necessary, such devices may be used only after the anti-virus inspection by the Network Administrator and with approval from a Deputy General Manager or an officer of a higher rank;

5.1.2.14个人办公用计算机须安装杀毒软件，并及时进行更新，不得故意传播，植入计

算机病毒，发现问题必须及时检测和清除计算机病毒并记录，对因计算机病毒等引起计算机瘫痪，程序和数据遭到破坏等重大事故，要保护现场，并及时报告网络管理员，由网络管理员处理；

5.1.2.14 Personal computers in offices shall be equipped with anti-virus software which shall

be timely updated. If any problem arises and any virus is suspected, the computer in question shall be tested and the virus shall be cleaned. If any virus causes failure of the computer system or damage to the software or data, the site shall be protected and the circumstance shall be reported to the Network Administrator for countermeasures;

5.1.2.15员工未经公司副总以上人员许可不得用手机接收公司邮件；

5.1.2.15 Employees may not access the email to or from the Company using a mobile phone without approval from a Deputy General Manager or an officer of a higher rank;

5.1.2.16 公司员工上网行为管理（见附件“个人计算机用户上网行为管理”）；

5.1.2.16 Management of employees’ online behaviors (Refer to Annex “Control of PC Users’ Online Behavior”);

5.1.2.17为支持节能环保，员工下班关闭计算机时，记得连同显示器电源一同关闭；

5.1.2.17 For the purpose of energy efficiency, employees shall cut off the power supply to the monitor when shutting down the computers;

5.1.2.18 因工作人员疏忽或操作失误，违反上述安全规定给公司造成影响带来损失的，

要严肃追究当事人责任。

5.1.2.18 If any adverse impacts or loss is caused to the Company because of any gross

negligence, mistaken operation or violation of foregoing safety regulations, the employee responsible shall be subject to punishment.

5.1.3计算机网络信息安全的日常工作。

5.1.3 Daily Information Safety Management of the Computer Network

5.1.3.1计算机安全检查；Computer Security Inspection

5.1.3.1.1公司网络管理员每季度的第一个星期对公司办公用计算机进行例行安全检

查；

5.1.3.1.1 The Network Administrator shall conduct routine safety inspection of computers

of the Company in the first week of each quarter;

5.1.3.1.2网络管理员检查时要严格按照计算机安全检查表（见附件“计算机例行巡检记

录表”）项检查，并准确记录检查结果；所有检查报告须有员工确认签字，对于检查

中发现有违反公司信息安全管理相关规定的情况需要进行单独登记；

5.1.3.1.2 The Network Administrator shall strictly conduct the inspection following the

annexed Record of Routine Inspection on Computers and keep accurate records of the inspection; all the inspection report shall be signed by the employee using the computer

and any violation of regulations concerning information safety management shall be separately recorded.

5.1.3.1.3员工计算机所安装软件须符合公司要求。多余的软件要删除，没有的软件要

补装；

5.1.3.1.3 All the software installed on employees’ computers shall be in compliance with

the requirements of the Company; Unwanted software shall be unloaded and required

software shall be installed;

5.1.3.1.4员工要积极主动配合公司网络管理员的检查，要提前做好自查自纠，数据备

份等工作，不得以任何借口拒绝检查。

5.1.3.1.4 Employees shall assist the Network Administrator in the inspection by self

inspection, self improvement and data backup and may not refuse to be inspected by any

excuse.

5.1.3.2信息安全培训；Information Safety Training:

人事行政部每年要组织员工开展一次信息安全培训，并且要进行考试，考试不合格则不能上岗。对核心员工签订《保密协议》后方能上岗。

The Personnel and Administration Department shall make arrangement for information safety training. A test will be administrated and those who fail in the test shall not be appointed to the designated posts. Key employees shall be appointed to the designated posts only after they have signed a Confidential Agreement with the Company.

5.2公司文件资料纸质文档的信息安全管理

5.2 Information Safety Management of Paper Files of the Company

5.2.1文件密级标识；Confidentiality Level Marking of the Files:

5.2.1.1自本管理办法发布之日起，各部门新产生文件必须标识密级；

5.2.1.1 New files released by individual departments shall be marked with the Confidentiality

Level from the date this policy is released;

5.2.1.2密级标识位置在电子文件页眉、介质表面、封皮；

5.2.1.2 The Confidentiality Level shall be marked at the position of the header of electronic files,

the surfaces of the media or the covers of paper files;

Office文件标识要求详见附件，其他各部门使用到的如AutoCAD、PDF文件等，请各部制定标准；

Please refer to the Annex for the marking of OFFICE files. Individual departments shall formulate standards for other files (e.g., AutoCAD or PDF files) they may use in the course of business operation;

5.2.1.3统一归口对外发放的文件，各部门文控人员负责标识密级、修改文件模板；

5.2.1.3 The File Controller of each individual department shall be responsible for the marking of

Confidentiality Levels and the modification of the templates of the files to be externally released collectively;

5.2.1.4员工对外发放文件，标识密级，自定义文件模板。

5.2.1.4 Employees shall mark the Confidentiality Level of the files to be externally released and

define file templates for such files.

5.2.2文件发放范围Scope of File Release:

5.2.2.1自本管理办法发布之日起，部门新产生文件必须标识文件审批人、发放范围；

5.2.2.1 New files released by individual departments shall be marked with the name of person

approving the file and the Scope of Release;

5.2.2.2审批人、发放范围可用表格方式在文件开始；

5.2.2.2 The name of person approving the file and the Scope of Release may be placed at the beginning of the file in a table;

5.2.2.3统一归口对外发放的文件，文控人员负责标识发放范围；

5.2.2.3 In the case of a file to be externally released, the File Controller shall mark the Scope of

Release;

5.2.2.4员工对外发放文件，自行标识发放范围；

5.2.2.4 Employees shall mark the Scope of Release of the file to be externally released on their

own;

5.2.3保密及知识产权声明；Confidentiality and IP Statement:

5.2.3.1自本管理办法发布之日起，对外发放文件必须加上保密及知识产权声明；

5.2.3.1 New files released externally shall be marked with the Confidentiality and IP Statements;

5.2.3.2声明包括：电子文件上，电子邮件（签名）上；

5.2.3.2 The Confidentiality and IP Statement shall be included in electronic files and the

signature of e-mails;

5.2.3.3电子邮件和文件的申明见附件；Refer to the annex for the Confidentiality and IP

Statement;

5.2.4文件传输及处理安全；File Transmission and Security of Transmission:

5.2.4.1任何员工在使用打印机时必须注意防止打印件信息泄密，任何打印文件都必须在打

印之后及时拿走；

5.2.4.1 Employees shall prevent leakage of information when printing files on the printer in

office and all printed files shall be taken away immediately;

5.2.4.2任何员工在使用传真机传真公司文件时必须注意防止信息泄密，对接受方需要提前

与之进行相关约定，重要信息传真时必须在传真前增加“保密声明”以确非授权访问者的责任；

5.2.4.2 Employees shall prevent leakage of information when transmitting files using the fax

machine. Appointments for the sending and receiving of such files shall be made beforehand, and, for the transmission of important files, the Confidentiality Statement shall be placed at the beginning of such files to be transmitted to define the responsibility of the person authorized to access the files;

5.2.4.3在传送方，必须保证及时取走，重要信息传真时必须制定授权范围内的人员操作。

对绝密文件，禁止使用传真方式进行传输；

5.2.4.3 When receiving a faxed file, the printed copy shall be taken away immediately and

important files shall be transmitted by authorized operators. Files of top confidentiality are prohibited to be transferred by means of fax;

5.2.4.4任何员工在使用复印机时必须注意防止原件及复印件信息泄密，任何文件必须即时

取走；

5.2.4.4 Employees shall prevent leakage of information when duplicating files on the copy

machine in office and all duplicated files shall be taken away immediately;

5.2.4.5任何员工在使用扫描仪时必须注意防止原件及扫描电子件的信息泄密，任何原文件

必须即时取走，电子扫描件在传输后必须在处理计算机中彻底清除；

5.2.4.5 Employees shall prevent leakage of information when scanning files on the scanner in

office. The original shall be take away immediately and the electronic copy of the file shall

be completely cleaned from the computer after it is transferred;

5.2.4.6任何员工在日常进行机密及绝密级文件销毁时必须使用碎纸机，或在定期的记录清

除中保证秘密级以上文件得到安全销毁。

5.2.4.6 Employees shall use the paper shredder to destroy all confidential files in the daily work

and ensure that all confidential files are safely destroyed in the regular record destruction. 6.0 参考文件References

《保密法》The Confidentiality Law

7.0 附件表格Annexed Tables

7.1『计算机健康巡检记录表』Computer Health Inspection Record

7.2『保密协议』Confidentiality Agreement

7.3『个人计算机用户上网行为管理』Control of PC Users’ Online Behavior

7.4『保密文件登记发放表』Record of Released Confidential Files

7.5『电子邮件和文件的申明』Statement in Electronic E-mails and Files