System Risk Management Policy

Laser Digital Japan Co., Ltd. (hereinafter referred to as "the Company") utilises computer systems in various business operations. The Company recognises as system risk the potential for loss to its customers and the Company arising from system deficiencies such as computer system downtime or malfunction, as well as the risk of loss to its customers and the Company due to the unauthorised use of computers. The Company recognises system risks as a responsibility and as one of its management risks. To prevent and minimise the occurrence of system risks, reduce losses arising from such risks, and ensure business continuity, the Company implements appropriate security measures for its systems. The Company has established this management policy and commits to its observance.

1.　Scope and Application

This management policy applies to all of our information assets and the operations related to their use and management, and applies to our officers, employees, and external contractors.

・　"Information systems" refer to all servers, end-user devices, computers, databases, networks, etc., used and owned by the Company for business purposes.

・　"Information assets" refer to the information itself contained within information systems and the mechanisms for managing and storing it.

2.　Establishment of System Risk Management Framework

The Company shall establish regulations in accordance with this Management Policy and develop a system risk management framework to promote system risk management and enable rapid response and recovery in the event of system risk incidents.

The system risk management framework shall be reviewed in response to changes in business operations, system implementation or disposal, and other events that may impact the framework, striving to implement effective risk management at all times.

3.　Identification, Analysis, Evaluation, and Determination of Response Policies for System Risks

(1)    The Company shall establish this management policy from the perspective of customer protection, taking into account alignment with medium- to long-term plans (management strategy and business strategy). Furthermore, the Company shall ensure that all officers and employees fully recognise the importance of system risk management. Based on risk characteristics and considering the allocation of management resources, the Company shall determine the achievement targets for safety measures and the management resources to be allocated to these safety measures.

(2)   The Company shall comprehensively investigate and identify system risks related to information systems, information assets, and the operations concerning their use and management on a regular and appropriate basis. Following analysis of vulnerabilities and threats, it shall evaluate the impact on the Company and its customers, the necessity for response, and other relevant factors.

(3)   The Risk Management Department shall take the lead in identifying, analyzing, and evaluating system risks, in collaboration with relevant departments such as the IT Systems Department, from a company-wide perspective. The results shall be reported to the Corporate Officer in charge of Risk Management and the Board of Directors. The response policy shall be determined upon approval by the Board of Directors.

(4)   Based on the response policy determined in the preceding paragraph, the Risk Management Department shall review this management policy, formulate security measures in cooperation with relevant departments, and support these departments in promptly implementing the security measures.

(5)   The implementation status of responses shall be reported periodically to the Information Security Committee and shall be promoted as part of the company-wide risk management.

4.　Information Security Management

The Company shall promote system risk management activities from an information security perspective to appropriately maintain the confidentiality, integrity, and availability of information assets.

5.　Cybersecurity Management

Recognising that cyber-attacks are becoming increasingly sophisticated and ingenious, the Company regards the prevention of cybersecurity incidents and rapid recovery response in the event of an incident as a critical management issue and shall establish a cybersecurity management framework.

・　"Cybersecurity incidents" refer to events where cybersecurity is threatened by so-called cyberattacks, such as unauthorised intrusion, information theft, falsification or destruction, system shutdowns or malfunctions, execution of malicious programmes, or DDoS attacks, carried out via cyberspace through the misuse of information and communications networks or information systems.

6.　System Risk Management for External Contractors

When outsourcing system development, operation, maintenance, or other system-related tasks to external contractors, the Company will, in accordance with relevant internal regulations, clearly define selection criteria and assess suitability. It will then ascertain and evaluate the system risk status at the external contractor to ensure safe and accurate outsourcing operations. Appropriate security measures will be requested to ensure the reliability of outsourced tasks.

7.　Formulation of Contingency Plans

The Company shall formulate contingency plans and establish a framework to enable prompt and appropriate measures in the event of emergencies such as system failures. Contingency plans shall be communicated to all officers and employees and reviewed regularly as necessary.

8.　Thorough Education and Awareness Regarding System Risks

We shall conduct awareness-raising activities and training on system risk to ensure our officers and employees recognise the nature of system risk within their own duties and can implement appropriate responses.

9.　Research and Investigation into the Latest Information System Technologies and Financial Crime Trends

To constantly address emerging system risks, the Company shall endeavour to gather information on the latest information system technologies and trends in financial crimes related to systems, promoting information sharing with relevant internal and external parties.

10.　Audits Concerning System Risk

The Company shall conduct regular and appropriate audits covering the entirety of system risk management, including its objectives, identification, analysis, evaluation, and response, as well as the compliance, effectiveness, and appropriateness of the associated processes and procedures.

Such audits are conducted as part of internal auditing. Where necessary, we endeavour to conduct external audits by independent experts with specialised knowledge of systems.

11.　Compliance with Laws and Regulations

The Company shall endeavour to gather information concerning laws and regulations related to information systems and shall establish a system to monitor the adaptation of changes to this management policy, internal regulations, and other documents, as well as the status of compliance, in the event of amendments or other changes.

Established 17 October 2025

Laser Digital Japan Co., Ltd.