Author: Huayu Enterprise Management - Business Research Department

When ESG assessments list cybersecurity as a "social responsibility," Taiwanese companies are facing an unavoidable supply chain check-up.

A warning from a factory

At the end of 2024, the purchasing manager of a medium-sized electronic component manufacturer in Taiwan received a letter from a major client. The letter was written in a calm tone, but every word was crucial: "In accordance with our new ESG supplier management regulations for 2026, please submit a cybersecurity questionnaire and improvement plan within 60 days, otherwise we will re-evaluate our cooperation relationship."

This factory has no chief cybersecurity officer and only two IT staff members, whose daily tasks of maintaining the ERP system are already at their limit. Faced with a dense array of cybersecurity requirements, the person in charge simply said, "We don't know where to begin." And this kind of scene is quietly playing out among thousands of suppliers in Taiwan.

One metric ignited the entire supply chain

In 2025, the Taiwan Stock Exchange officially renamed its "Corporate Governance Assessment" to "ESG Assessment," launching its first new indicator system. Among all the new additions, S-15, which strengthens the regulatory requirements for suppliers' information security and privacy protection , became the most hotly debated item in the industry.

This is not just a name change. It represents a fundamental shift in logic: cybersecurity is no longer a technical issue for the IT department, but a perpetual responsibility of corporate governance.

The core requirement of S-15 is "penetration"—the assessed company must not only be compliant itself, but also extend its protection network to the entire supply chain. In other words, your cybersecurity strength depends on your most vulnerable supplier. This logic has made many senior executives uneasy for the first time.

Pressure coming from both directions simultaneously

S-15 creates a dual pressure structure, affecting both upstream and downstream companies. For the companies being assessed , the challenge lies in scale and complexity. A medium-sized manufacturer often has a supplier list of three to five hundred companies, with diverse backgrounds and sizes. How to effectively audit these manufacturers without overwhelming its own administrative resources is a real challenge.

For suppliers (especially SMEs), this is more like a survival test. Cybersecurity compliance is rapidly becoming a "ticket" to enter the supply chain. Those who fail to meet the standards face not just fines, but the market risk of being directly removed from the list.

"Compliance" is becoming a new competitive barrier.

Four lines of defense: From passively filling out forms to proactive governance

Signing a non-disclosure agreement (NDA) is just the beginning in dealing with S-15; it's far from enough. Truly competitive companies are building a systematic supply chain cybersecurity governance architecture.

The first line of defense: Supplier risk grading. Not all suppliers pose the same risk. Companies should establish a high, medium, and low risk grading system based on the extent to which suppliers have access to sensitive data (R&D data, customer personal information) and their operational importance, along with differentiated audit frequencies and requirements. Focusing resources on key areas is the pragmatic approach.

The second line of defense: Standardization and digitalization. Leveraging the stock exchange's ESG digital platform architecture, standardized questionnaires replace fragmented document exchanges. Actively promoting international certifications such as ISO 27001 among suppliers, and using third-party verification to eliminate the cost waste of duplicate audits from multiple clients in one go.

The third line of defense: Integrating privacy into product design. S-15 specifically highlights privacy protection. Companies should assist suppliers in incorporating data protection logic into product design during the development phase, rather than as a last resort. From data transmission and storage to destruction, every step must comply with regulatory requirements. This embodies the internationally prevalent spirit of "Privacy by Design."

The fourth line of defense: Building a collaborative defense ecosystem. Cybersecurity should not be a punishment, but an empowerment. Leading companies have begun holding "Supplier Cybersecurity Days" and providing mentoring resources, viewing cybersecurity capabilities as an investment in the overall resilience of the supply chain. When your suppliers are stronger, you are safer. This is also the most persuasive and positive narrative in evaluations.

Time window: Only these remain for businesses

The data from the 115-year evaluation covers the actual actions taken in the previous year. This means that planning must begin now.

• First half of 2025 : Review the supplier list and complete risk classification; examine procurement contracts and strengthen cybersecurity and privacy protection clauses.
• Second half of 2025 : Release the "Supplier Cybersecurity Code of Conduct"; initiate audits of high-risk vendors and require them to make improvements within a specified period.
• Early 2026 : Compile the annual management results (audit completion rate, improvement achievement rate) and incorporate them into the sustainability report, specifically responding to S-15 requirements.
• After 2026 : Based on the evaluation feedback, continuously optimize and normalize the supply chain cybersecurity management mechanism.

The window of opportunity left for businesses is narrower than imagined.

Cybersecurity is the most expensive form of trust in this era.

The true significance of S-15 lies not in its ranking score, but in forcing companies to confront a long-overlooked fact: in the era of digital supply chains, trust has boundaries, and maintaining those boundaries requires cost and systems. Companies that establish such systems early will become "trustworthy partners" in the eyes of their customers; while those that are still waiting and watching will ultimately pay a far higher price than compliance after a cybersecurity incident. When cybersecurity becomes a standard feature for entering the international supply chain, the timing of your implementation will determine whether you are a leader or a follower.

The indicators mentioned in this article are based on the ESG assessment announcements of the Taiwan Stock Exchange. Companies should pay close attention to the latest official announcements.

-----------------------------------------------------------------------------------------------------------------

Related services:

• ISO/IEC 27001 Information Security Management
• ISO/IEC 42001 Artificial Intelligence Management System

If you have any questions, please feel free to contact us. We are happy to assist you.