In order to further solidify internal and client information security, Noah in 2018 commenced on a journey for and in 2020 succeeded in the obtainment of ISO 27001 information security management system certification and ISO 29151 code of practice for personally identifiable information protection certification. These efforts help bolster Noah's reliability in information security, reduce the risk of sensitive information leakage and augment the protection of key data. Noah's client and internal data protection mechanisms have become more systematic and comprehensive, with a more defined privacy protection strategy and better reinforced privacy protection measures.
Through a four-stage endeavor (analysis, realization, operation and verification), Noah identified and assessed existing and potential risks, formulated corresponding risk management plans, and completed the establishment of its information security management system and processes. External evaluation and non-conformance rectification were completed in September 2020, while the Noah Upright Fund Sales Co., Ltd. - Science and Technology Center successfully obtained ISO 27001 and ISO 29151 certifications issued by the accredited certification body DNV. The certification body evaluates Noah's information security management system compliance every year.
Noah demonstrates to clients, competitors, suppliers, employees and investors our commitment to information security through the obtainment of ISO 27001 and ISO 29151 certifications. In the future, we will regularly monitor the evaluation process, and ensure continual supervision and improvement in the organization's information system, so that clients and stakeholders alike can truly feel at ease because of our commitment to information security.

To meet the requirements of national laws and regulations such as the Cybersecurity Law of the People’s Republic of China and the Measures for the Regulation of Informatization Work of Insurance Intermediaries issued by the China Banking and Insurance Regulatory Commission, Noah keeps enhancing its control over cybersecurity and data security. In 2020, Noah invited external professional evaluation agencies to conduct a series of consulting and evaluation work for Noah Glory insurance brokerage system, Noah Upright’s official website, and private equity core trading systems.
Glory insurance brokerage system and private equity core trading system have successfully passed the MLPS III evaluation. In addition, Noah Upright’s official website has given the MLPS II evaluation, reaching a good level.

Noah Upright employees must follow the principles of minimum authorization and the necessity to know when accessing clients’ private data. Suppose it is necessary to extract or disclose clients’ private data to external regulatory authorities in daily operation, prior approvals from the applicant’s supervisor, data owner, and Noah Upright’s Information Security Department shall be obtained.
• Employees must sign confidentiality agreements before employment, receive continuous training during their work, and are strictly prohibited from disclosing Noah Upright’s client information. In addition, Non-Noah Upright employees such as external consultants and technical support personnel must sign confidentiality agreements before work and may not have access to Noah Upright’s clients’ privacy information.
• Noah Upright’s Information Security Department conducts annual inspections to protect clients’ private data and punishes violations of security regulations following the Company’s management regulations; cases involving violations of law will be referred to the judicial department.
Noah has information security incident reports phone numbers, emails, and WeChat accounts for internal and external feedbacks that may involve leakage and will be filed for investigation. If Noah Upright’s reasons cause client privacy leakage, the problem will be rectified. The relevant personnel will be held responsible. In 2021, Noah has no client information leakage.

Information Security Week is an information security awareness training that is mandatory for all Noah employees. In addition to information security education, a series of information security activities will be carried out to reinforce security awareness of all employees.
During Information Security Week 2021, a number of information security awareness and education activities were launched for all Noah employees, including Mandatory online course on information security awareness for all employee, Phishing email test, Offline security threat experience, Offline security threat experience and Information security inspection in the workplace, in order to enhance and improve employees' information security awareness. More than 500 employees participated, and workplace security inspection problems reduced by 70% compared with last year. Noah employees have established good information security awareness.
Noah Information Security Awareness Training:
1. Mandatory online security awareness course
2. Phishing email test
3. Offline security threat experience
4. Security display board and daily security short video
5. Workplace information security inspection

To prevent the leakage of sensitive client information, Noah has developed Sensitive Information Management Specification, which defines client-sensitive information and cooperates with a series of control measures to effectively reduce the risk of client information leakage.
In 2021, Noah implemented a policy to ban personal WeChat and QQ from office computers and company networks, effectively reducing the risk of leakage of employees’ sensitive information transmitted by personal instant-messaging tools. In addition, to meet the requirement of traceable compliance in the sales process, Noah has deployed a WeCom archiving system to archive the dialogues of all employees of the Company and ensure that records of all conversations with clients in the WeCom are stored locally.
In addition, sensitive words shall be set up in the system, under which sales personnel are required to contact clients via WeCom. They shall not take the initiative to ask for clients’ contact information during the sales process, nor shall they make promises to clients regarding proceeds during the sales process. If any sensitive word is triggered, an automatic message warning will be sent to personnel at the security audit position and the compliance position to handle the event of violations.
We successively close down the Internet access channels to reduce the Internet attack surface and risk exposure of the Company system. We also continue to implement the mobile APP security reinforcement project. As a result, the Company’s client-oriented App can complete code encryption through the security reinforcement platform to enhance APP application and data security.
In addition, Noah also carries out various emergency plan drills every year and responds to the cloud-based scenario in 2021. We have carried out disaster recovery drills for public and private equity trading systems and Inoah systems to ensure that such architecture is effective and highly available, has the capability of disaster recovery, and meets business continuity requirements.

In 2021, Noah formulated the Noah Emergency Plan for Client Information Leakage. According to the Plan, if any of our clients’ information disclosure is detected, the Information Security Department will uniformly organize early warning response work, launch the Emergency Plan, and determine the security level of such incident. It will also notify the relevant business collaboration entity to handle such incidents and keep evidence.
For a preeminent client information leakage event that meets the conditions for regulatory reporting, the Information Security Department and Compliance Department of the Group shall send a summary report in writing to the cybersecurity department and other regulatory authorities where the event occurs.

The Attack and Defense Drill (ADD) is a fully simulated actual combat of attack and defense. For all domestic and foreign external businesses of the Group, more than a dozen cyberattack scenarios are simulated to test the Company’s work achievements in information security management, technical prevention and control, and security contingency stages. By virtue of the actual combat drill, the security awareness of corporate technical personnel will be enhanced, the attack and defense skills of the security department will be tempered, the potential risks of information systems will be disclosed, and the improvement and upgrading of information security governance will be promoted.
In 2021, Noah hired an external professional security service agency to implement an ADD project for one month. During the project, the defender (Blue Team) of Noah Information Security Department and science and technology operation teams successfully detected more than 10 attack nodes from inside and outside China, involving domestic operators, public cloud, Europe and the United States, Southeast Asia, etc. In the process of attack and defense, Noah’s protection mechanism successfully intercepted all external attacks at all technical levels. At the same time, in the risk assessment of the business process, the security risks in the information system were effectively identified, and all the risk items were rectified after the drill. Through this actual combat, the security team can have a clearer understanding of its shortcomings, pointing out the direction for the evolution and exploration of security governance in the technical respect.