XML 43 R29.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Mar. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We believe that cybersecurity and business resilience are critical to advancing our corporate vision and enabling our digital transformation efforts. As a technology services provider, we are faced with a multitude of diverse cybersecurity threats that range from common attacks such as ransomware, denial of service, and social engineering to more advanced attacks leveraging sophisticated AI-enabled tools from nation-state actors that might target our ecosystem through specific industry verticals. Any such cybersecurity threats could affect our customers, vendors, service providers, subcontractors and/or employees, and a cybersecurity threat to us or any of these entities could materially adversely affect our business strategy, financial condition, performance, our brand and results of operations.
We have a dedicated team of information security professionals (our “information security team”) who lead our enterprise-wide cybersecurity strategy, which includes risk management, cyber defense, systems security, security monitoring and other related functions. This team is overseen by our Senior Director of Information Security (“SDIS”) who reports to our Chief Information Officer (“CIO”). The SDIS has over 25 years of experience in the field of cybersecurity and is responsible for our overall business resilience and information security strategy, security engineering and operations, cyber threat detection and response, and policy recommendations. In addition, our SDIS has a significant background in general information technology and program management. Our information security team manages our robust enterprise security structure, which is designed to prevent cybersecurity incidents, while simultaneously increasing our technology resilience to minimize the associated business impact of cybersecurity threats. Core to our information security team’s structure is our security incident response team, which is responsible for the protection, detection and overall response capabilities in defense of our corporate resources and assets. Furthermore, we believe strongly in a supportive and collaborative culture of security, whereby all our employees maintain a role in our corporate cybersecurity posture, including but not limited to their participation in periodic training and risk management exercises throughout the year.
The processes overseen by our information security team are integrated with our enterprise risk management (“ERM”) program, including routine reporting to our executive team on cyber risk through the different levels of our ERM governance structure including our risk management frameworks and processes. We undergo routine testing of both the design and operational effectiveness of our security controls, consult with industry leaders on best practices, and ensure alignment with relevant industry frameworks and laws, as well as auditing by our internal audit team. Our cybersecurity program consists of policies, practices and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection, threat containment and risk assessments. In addition to our policies and procedures designed to manage and identify cybersecurity risks, we maintain an incident response plan designed to contain, analyze, remediate, and communicate cybersecurity matters to help ensure a timely and appropriate response to cybersecurity incidents.
Additionally, we engage third-party firms to conduct routine external and internal penetration testing of our information systems to emulate the common tactics and techniques of cyber threat actors, and we have developed processes to remediate identified vulnerabilities across a wide range of severities. We have policies and procedures to oversee and identify the cybersecurity risks associated with our use of certain third-party service providers. These policies and procedures include onboarding risk assessments prior to engagement and, as appropriate based on identified risk, may include either cybersecurity-related contractual terms and/or periodic risk assessments throughout the life cycle of the third-party relationship. We maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to the remediation of cybersecurity incidents.
Our Board has ultimate oversight of our cybersecurity risk, which it oversees as part of our ERM program. The CIO and SDIS regularly provide reporting on cybersecurity to both our executive management and our Board. This reporting includes updates on our information security strategy and organizational structure, key cyber risks and threats, progress related to various initiatives designed to protect us from such risks and threats, assessments of our cybersecurity program and emerging trends, including those related to the use of AI as both a threat and a defense mechanism. Depending on the criticality of a cybersecurity incident and in accordance with our incident response plan, certain matters are required to be reported promptly to the Board, as appropriate.
As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, financial condition, or our brand. However, we cannot provide assurance that such threats will not be discovered, occur, or result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, please refer to Item 1A. “Risk Factors.”
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] We have a dedicated team of information security professionals (our “information security team”) who lead our enterprise-wide cybersecurity strategy, which includes risk management, cyber defense, systems security, security monitoring and other related functions. This team is overseen by our Senior Director of Information Security (“SDIS”) who reports to our Chief Information Officer (“CIO”).
Cybersecurity Risk Role of Management [Text Block]
We have a dedicated team of information security professionals (our “information security team”) who lead our enterprise-wide cybersecurity strategy, which includes risk management, cyber defense, systems security, security monitoring and other related functions. This team is overseen by our Senior Director of Information Security (“SDIS”) who reports to our Chief Information Officer (“CIO”). The SDIS has over 25 years of experience in the field of cybersecurity and is responsible for our overall business resilience and information security strategy, security engineering and operations, cyber threat detection and response, and policy recommendations. In addition, our SDIS has a significant background in general information technology and program management. Our information security team manages our robust enterprise security structure, which is designed to prevent cybersecurity incidents, while simultaneously increasing our technology resilience to minimize the associated business impact of cybersecurity threats. Core to our information security team’s structure is our security incident response team, which is responsible for the protection, detection and overall response capabilities in defense of our corporate resources and assets. Furthermore, we believe strongly in a supportive and collaborative culture of security, whereby all our employees maintain a role in our corporate cybersecurity posture, including but not limited to their participation in periodic training and risk management exercises throughout the year.
Cybersecurity Risk Board of Directors Oversight [Text Block]
We have a dedicated team of information security professionals (our “information security team”) who lead our enterprise-wide cybersecurity strategy, which includes risk management, cyber defense, systems security, security monitoring and other related functions. This team is overseen by our Senior Director of Information Security (“SDIS”) who reports to our Chief Information Officer (“CIO”). The SDIS has over 25 years of experience in the field of cybersecurity and is responsible for our overall business resilience and information security strategy, security engineering and operations, cyber threat detection and response, and policy recommendations. In addition, our SDIS has a significant background in general information technology and program management. Our information security team manages our robust enterprise security structure, which is designed to prevent cybersecurity incidents, while simultaneously increasing our technology resilience to minimize the associated business impact of cybersecurity threats. Core to our information security team’s structure is our security incident response team, which is responsible for the protection, detection and overall response capabilities in defense of our corporate resources and assets. Furthermore, we believe strongly in a supportive and collaborative culture of security, whereby all our employees maintain a role in our corporate cybersecurity posture, including but not limited to their participation in periodic training and risk management exercises throughout the year.
The processes overseen by our information security team are integrated with our enterprise risk management (“ERM”) program, including routine reporting to our executive team on cyber risk through the different levels of our ERM governance structure including our risk management frameworks and processes. We undergo routine testing of both the design and operational effectiveness of our security controls, consult with industry leaders on best practices, and ensure alignment with relevant industry frameworks and laws, as well as auditing by our internal audit team. Our cybersecurity program consists of policies, practices and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection, threat containment and risk assessments. In addition to our policies and procedures designed to manage and identify cybersecurity risks, we maintain an incident response plan designed to contain, analyze, remediate, and communicate cybersecurity matters to help ensure a timely and appropriate response to cybersecurity incidents.
Additionally, we engage third-party firms to conduct routine external and internal penetration testing of our information systems to emulate the common tactics and techniques of cyber threat actors, and we have developed processes to remediate identified vulnerabilities across a wide range of severities. We have policies and procedures to oversee and identify the cybersecurity risks associated with our use of certain third-party service providers. These policies and procedures include onboarding risk assessments prior to engagement and, as appropriate based on identified risk, may include either cybersecurity-related contractual terms and/or periodic risk assessments throughout the life cycle of the third-party relationship. We maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to the remediation of cybersecurity incidents.
Our Board has ultimate oversight of our cybersecurity risk, which it oversees as part of our ERM program. The CIO and SDIS regularly provide reporting on cybersecurity to both our executive management and our Board. This reporting includes updates on our information security strategy and organizational structure, key cyber risks and threats, progress related to various initiatives designed to protect us from such risks and threats, assessments of our cybersecurity program and emerging trends, including those related to the use of AI as both a threat and a defense mechanism. Depending on the criticality of a cybersecurity incident and in accordance with our incident response plan, certain matters are required to be reported promptly to the Board, as appropriate.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The SDIS has over 25 years of experience in the field of cybersecurity and is responsible for our overall business resilience and information security strategy, security engineering and operations, cyber threat detection and response, and policy recommendations. In addition, our SDIS has a significant background in general information technology and program management.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our information security team manages our robust enterprise security structure, which is designed to prevent cybersecurity incidents, while simultaneously increasing our technology resilience to minimize the associated business impact of cybersecurity threats. Core to our information security team’s structure is our security incident response team, which is responsible for the protection, detection and overall response capabilities in defense of our corporate resources and assets.
Cybersecurity Risk Management Processes Integrated [Text Block] The processes overseen by our information security team are integrated with our enterprise risk management (“ERM”) program, including routine reporting to our executive team on cyber risk through the different levels of our ERM governance structure including our risk management frameworks and processes.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Board has ultimate oversight of our cybersecurity risk, which it oversees as part of our ERM program.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The CIO and SDIS regularly provide reporting on cybersecurity to both our executive management and our Board. This reporting includes updates on our information security strategy and organizational structure, key cyber risks and threats, progress related to various initiatives designed to protect us from such risks and threats, assessments of our cybersecurity program and emerging trends, including those related to the use of AI as both a threat and a defense mechanism. Depending on the criticality of a cybersecurity incident and in accordance with our incident response plan, certain matters are required to be reported promptly to the Board, as appropriate.
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, financial condition, or our brand.