Company: XHG
Filing Date: 2025-01-22
Form Type: 20-F
Source: 0001213900-25-005499
Chunk: 179

Company: XChange TEC.INC
Filing Date: 2025-01-22
Form: 20-F
Item: Item 16K
Chunk 179
---
ITEM
16K. CYBERSECURITY

Risk
Management and Strategy

We
have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats and haveintegratedthese processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats
that may result in adverse effects on the confidentiality, integrity, or availability of their information systems or any information
residing therein.

We
conduct risk assessments to identify cybersecurity threats in accordance with the Cybersecurity Law and Data Security Law of the PRC
and our relevant procedures and policies. We conduct quarterly and monthly security inspections of, including but not limited to, network
boundary security protection, wireless network security protection, network security protection and server inspection. If any existing
or potential vulnerabilities, suspicious activities or potential risks are identified during the security inspection, the IT Department
will scan the subject system and identify the particular network vulnerability, analyze the potential internal and external risks and
review the sufficiency of existing policies, procedures and safeguards in place. The IT Department will implement remedial actions, including
but not limited to, modifying, repairing or updating subject program or software, installing and maintaining safeguards, improving data
classification, updating access control and encryption standards, amending existing procedures, policies or emergency response protocols
and conducting security training.

As
part of the overall risk management strategies, we also conduct cybersecurity trainings for our employees.

During
the fiscal year ended September 30, 2024 and to the date of this Annual Report, we have not experienced any material cybersecurity incidents
or identified any material cybersecurity threats that have affected or are reasonably likely to materially affect us and our business
strategy, results of operations or financial condition.

Governance

Our
Chief Executive Officer and Chief Financial Officer will annually present to the Audit Committee and the Board of Directors about the
Company’s and the PRC operating entities’ cybersecurity related risk assessments and management, including but not limited
to, relevant internal rules and policies, assessment of potential cybersecurity threats or risks, improvements and prevention measures.
In the event that the management discovers that a material cybersecurity incident occurs, the Chief Executive Officer and/or the Chief
Financial Officer will timely report such incident to the Audit Committee and the Board of Directors, with respect to material aspects,
including but not limited to, the nature, scope, timing, the remedial measures and risk mitigation processes taken by the Company and
the PRC operating entitles, material impact to the Company and the PRC operating entities, and any