XML 50 R35.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Cybersecurity Risk Management and Strategy
The Company’s cybersecurity program is designed to protect and preserve the confidentiality, integrity, and availability of our networks and systems, as well as information that we own or is in our care, through a risk-based approach. The Company’s program may leverage aspects of U.S. National Institute for Standards and Technology standards and other applicable industry frameworks. Our cybersecurity program identifies, assesses, and manages material risks from cybersecurity threats by implementing robust practices, processes, and technologies designed to protect our data digital assets and data.
Our cybersecurity program includes:
annual compliance training, which includes modules on information security, and provides quarterly phishing simulation exercises to reinforce awareness and enhance cybersecurity practices;
intrusion detection by monitoring network and system activities to detect unusual or suspicious behavior;
access management and access controls which aim to implement “least privilege” access;
protection of sensitive data through “at rest” and “in transit” encryption;
industry-standard monitoring and protection software;
a defined vulnerability management program;
periodic cybersecurity assessments, including with the support of independent third-party consultants;
developing plans for recovering from security incidents and maintaining business continuity in the face of cyberattacks; and
a cybersecurity incident response plan that provides controls and procedures to support timely and accurate reporting of cybersecurity incidents.
The Company’s cybersecurity program is integrated within the Company’s enterprise risk management program, which provides oversight and governance of cybersecurity risk through risk assessment, risk monitoring, and follow-through on stated objectives and investments to actively manage and remediate related risks.
The Company maintains arrangements with third party information infrastructure (IT) vendors—including “cloud computing” vendors. The Company has processes designed to manage cybersecurity risks arising from our use of such vendors, including conducting risk assessments prior to integration into the Company’s networks and additional assessments prior to contract renewals or extensions. Cybersecurity measures employed by significant third-party service providers are also further analyzed prior to introduction into our environment. The Company also commissions third-party risk assessments of certain IT vendors to identify and evaluate risks associated with each third party and to minimize potential disruptions and liabilities that may arise from external partnerships. We further manage potential threats to our systems originating with or associated with IT vendors by integrating cybersecurity requirements and other provisions into various contracts as applicable. Vulnerabilities in third-party software are monitored and managed through our vulnerability management program.
To date, the risks from cybersecurity threats have not materially affected the Company. Our cybersecurity program is designed to detect and prevent cybersecurity events that would have a material adverse effect on the Company. Despite our efforts, however, the threat of sophisticated, targeted computer crime poses a risk to the security of our systems and networks and the confidentiality, availability, and integrity of our data. Notwithstanding our efforts to protect intellectual property and confidential and personal information, our facilities and systems may be vulnerable to cybersecurity events. See “Item 1A. Risk Factors – Risks Related to our Business.
We maintain insurance covering certain costs that we may incur in connection with cybersecurity incidents, which we believe is commensurate with the size and the nature of our operations. However, the Company may incur expenses and losses related to a cyber incident that are not covered by insurance or are in excess of our insurance coverage.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
The Company’s cybersecurity program is integrated within the Company’s enterprise risk management program, which provides oversight and governance of cybersecurity risk through risk assessment, risk monitoring, and follow-through on stated objectives and investments to actively manage and remediate related risks.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
The Company’s Chief Information Security Officer (“CISO”) is responsible for cybersecurity at the executive level. The CISO oversees a team of cybersecurity professionals responsible for assessing and managing our material risk from cybersecurity threats. The CISO works closely with the Chief Information Officer and reports to the Chief Financial Officer and Chief Administrative Officer. The CISO also leads a cross-functional Cybersecurity Incident Response Team (“CSIRT”) responsible for responding to and managing cybersecurity incidents. The CSIRT consists of professionals from various
departments within SEI, including Information Technology, Information Security, Legal, Finance, Enterprise Risk Management, Human Resources, and other key business areas. The CISO has extensive expertise in cybersecurity, including over two decades of experience at a federal law enforcement agency, where responsibilities included technical risk management, information security, cyber investigations, incident response, and cyber strategy. In addition to the CISO’s professional background, the CISO maintains several relevant industry credentials.
The Audit Committee of the Company’s Board of Directors, which is wholly comprised of independent directors, is tasked with oversight of the Company’s enterprise risk assessment and risk management policies and guidelines, including cybersecurity. The Audit Committee receives quarterly cybersecurity updates from the Chief Information Officer and/or the CISO. Each update includes, among other topics, a summary of SEI cybersecurity events, vulnerability management, ransomware readiness, and global cybersecurity trends across industries. The Audit Committee also receives updates from Internal Audit, which may report on cybersecurity in the context of enterprise risk management. The Audit Committee updates the Board of Directors as appropriate.
The Company maintains a process to escalate certain cybersecurity incidents promptly so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
The Company’s Chief Information Security Officer (“CISO”) is responsible for cybersecurity at the executive level. The CISO oversees a team of cybersecurity professionals responsible for assessing and managing our material risk from cybersecurity threats. The CISO works closely with the Chief Information Officer and reports to the Chief Financial Officer and Chief Administrative Officer. The CISO also leads a cross-functional Cybersecurity Incident Response Team (“CSIRT”) responsible for responding to and managing cybersecurity incidents. The CSIRT consists of professionals from various
departments within SEI, including Information Technology, Information Security, Legal, Finance, Enterprise Risk Management, Human Resources, and other key business areas. The CISO has extensive expertise in cybersecurity, including over two decades of experience at a federal law enforcement agency, where responsibilities included technical risk management, information security, cyber investigations, incident response, and cyber strategy. In addition to the CISO’s professional background, the CISO maintains several relevant industry credentials.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
The Audit Committee of the Company’s Board of Directors, which is wholly comprised of independent directors, is tasked with oversight of the Company’s enterprise risk assessment and risk management policies and guidelines, including cybersecurity. The Audit Committee receives quarterly cybersecurity updates from the Chief Information Officer and/or the CISO. Each update includes, among other topics, a summary of SEI cybersecurity events, vulnerability management, ransomware readiness, and global cybersecurity trends across industries. The Audit Committee also receives updates from Internal Audit, which may report on cybersecurity in the context of enterprise risk management. The Audit Committee updates the Board of Directors as appropriate.
Cybersecurity Risk Role of Management [Text Block]
The Company’s Chief Information Security Officer (“CISO”) is responsible for cybersecurity at the executive level. The CISO oversees a team of cybersecurity professionals responsible for assessing and managing our material risk from cybersecurity threats. The CISO works closely with the Chief Information Officer and reports to the Chief Financial Officer and Chief Administrative Officer. The CISO also leads a cross-functional Cybersecurity Incident Response Team (“CSIRT”) responsible for responding to and managing cybersecurity incidents. The CSIRT consists of professionals from various
departments within SEI, including Information Technology, Information Security, Legal, Finance, Enterprise Risk Management, Human Resources, and other key business areas. The CISO has extensive expertise in cybersecurity, including over two decades of experience at a federal law enforcement agency, where responsibilities included technical risk management, information security, cyber investigations, incident response, and cyber strategy. In addition to the CISO’s professional background, the CISO maintains several relevant industry credentials.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Audit Committee of the Company’s Board of Directors, which is wholly comprised of independent directors, is tasked with oversight of the Company’s enterprise risk assessment and risk management policies and guidelines, including cybersecurity.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The CISO has extensive expertise in cybersecurity, including over two decades of experience at a federal law enforcement agency, where responsibilities included technical risk management, information security, cyber investigations, incident response, and cyber strategy. In addition to the CISO’s professional background, the CISO maintains several relevant industry credentials.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Each update includes, among other topics, a summary of SEI cybersecurity events, vulnerability management, ransomware readiness, and global cybersecurity trends across industries. The Audit Committee also receives updates from Internal Audit, which may report on cybersecurity in the context of enterprise risk management. The Audit Committee updates the Board of Directors as appropriate.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true