Company: XHG
Filing Date: 2025-01-22
Form Type: 20-F
Source: 0001213900-25-005499
Chunk: 180

Company: XChange TEC.INC
Filing Date: 2025-01-22
Form: 20-F
Item: Item 16K
Chunk 180
---
 prevention measures or improvements
to be implemented. Our Audit Committee is responsible to discuss guidelines and policies governing the process in connection with the
assessment and management of the Company’s exposure to risks. Our Board of Directors is responsible to (i) maintain oversight of
the disclosure related to cybersecurity matters in current reports or periodic reports of our company, (ii) review updates to the status
of any material cybersecurity incidents or material risks from cybersecurity threats to our Company and the PRC operating entities, and
the relevant disclosure issues, if any, presented by our Chief Executive Officer, Chief Financial Officer, and (iii) review disclosure
concerning cybersecurity matters in our annual report on Form 20-F presented by our Chief Executive Officer and Chief Financial Officer.

The
PRC operating entities have adopted the Data Classification and Grading Rules for the purposes to achieve efficient data management and
ensure the integrity, confidentiality and availability of data. The Information and Security Officer, together with IT Department, is
responsible for the maintenance, amendment, and the interpretation of the Data Classification and Grading Rules and the review and identification
of classification and grading of data. The head of each department is responsible for the management of data classification and grading
within the department. The IT Department will annually review the implementation of data classification and grading among the different
departments.

The
PRC operating entities have also adopted the Cybersecurity Incident Response Policies and Rules (the “ Cybersecurity Policies and
Rules”), which regulates the discovery, reporting, response, recovery and prevention of cybersecurity incidents. The Cybersecurity
Policies and Rules provides the guidance and procedures for various information security/data breach scenarios, including but not limited
to, incident discovery and initial response, internal reporting, emergency response team establishment, event classification and priority
determination, investigation and implementation of containment measures, repair and recovery, incident reporting and post-incident analysis
and improvement, and regular internal training. The Cybersecurity Policies and Rules applies to cybersecurity incidents that occur among
all the departments, employees and third-party service providers of PRC operating entities that use the company’s network, systems
and data.

The
Information and Security Officer are primarily responsible for building strategies of the IT infrastructures (including security matters),
software and hardware management, security training and security monitoring of online operations, including those described in “ Risk
Management and Strategy” above.

PART
III