XML 16 R9.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management Strategy and Governance
12 Months Ended
Mar. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Item 16K. Cybersecurity

Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is managed by our Chief Information Security Office (“CISO”) function. Our cybersecurity risk management framework is defined and implemented to identify, assess and manage cyber risks for our information assets. Cybersecurity risks are tracked and monitored by the risk owners and governed by the CISO to maintain them within acceptable levels.

Threats and vulnerabilities are identified, and cybersecurity risks are assessed based on their potential impact on the confidentiality, integrity, and availability of information systems and facilities. Identified cybersecurity risks are analyzed based on the likelihood of a threat occurrence and its impact on business operations, and risk treatment plans are prepared and implemented accordingly. Cybersecurity risk assessment results and the status of the risk treatment plan are reviewed by management on a periodic basis.

We assess and govern the cybersecurity program using selected industry best practices and frameworks from the International Organization for Standardization and the National Institute of Standards and Technology. The framework includes policies, standards and procedures that help assess and identify our cybersecurity risks and inform how security measures and controls are implemented and maintained. For assessing risks, multiple factors are considered including likelihood and severity of risk, impact on the Company if a risk materializes, feasibility and cost of controls and impact of controls on operations.

We periodically assess the cybersecurity risk posture of acquired entities to ensure relevant security measures are in place. Through regular monitoring and evaluations, we identify and mitigate potential vulnerabilities before they can become significant risks to the organization.

To help protect us from any major cybersecurity incident that could have a material impact on our operations or financial results, we have implemented controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps taken to reduce vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to establishing information security policies and standards, implementing information protection processes and technologies, monitoring our information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with external organizations on cyber threat information and best practices. We have implemented a Cybersecurity Incident Response Procedure, which is integrated into our overall crisis management program. The procedure provides a plan for responding to cybersecurity incidents.

We maintain internal resources to perform penetration testing designed to simulate evolving tactics and techniques of real-world threat actors, engage with industry partners and conduct tabletop exercises on an as-needed basis. We also engage independent third parties to perform red teaming and breach attack simulation exercises periodically. We require key third-party service providers to give assurance that they have the ability to implement and maintain appropriate security measures, consistent with applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may materially affect our company.

In addition, we continue to focus on training and awareness practices to mitigate risk from human errors, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing awareness campaigns that are designed to emulate real-world contemporary threats. We provide feedback and additional training based on the results of such exercises.

During the year ended March 31, 2025, we did not identify any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For additional information regarding cybersecurity risks, please refer to Item 3, “Risk Factors,” in this Annual Report on Form 20-F, including the risk factor titled “Cyberattacks and other security incidents, both real and perceived, impacting the confidentiality and integrity of our information technology and digital infrastructure could lead to loss of reputation and financial obligations”.

Cybersecurity Governance

Risk Management teams within the CISO function, Business units, and support functions are responsible for identifying and assessing cybersecurity risks on an ongoing basis and establishing processes to ensure such potential cybersecurity risk exposures are monitored, and remediated through relevant cybersecurity controls.

Our cybersecurity process is defined and governed by our CISO function and implemented by our Chief Information Office (“CIO”) function. Our CISO has over 25 years of experience in the cybersecurity and technology industry, and reports to the Chief Operating Officer ("COO"). The CISO works closely with our CIO, who manages our information technology and security operations. The CISO and CIO have a set of responsibilities to govern and implement security policies and technology controls across the organization.

Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Audit, Risk and Compliance Committee of our Board has primary oversight responsibility for cybersecurity risks. The Audit, Risk and Compliance Committee regularly reviews and discusses the Company's cybersecurity framework and programs, the status of projects to strengthen our cybersecurity programs, results from third-party assessments, and any material cybersecurity incidents, including recent incidents at other companies and the emerging threat landscape, with our CISO, CIO, Chief Risk and Assurance Officer and COO. The Audit, Risk and Compliance Committee also reviews the implementation and effectiveness of the Company’s controls to monitor and mitigate cybersecurity risks with management. In addition, our Board of Directors receives an annual report, with quarterly written updates regarding our cybersecurity program and material security incident reports on need basis.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]

To help protect us from any major cybersecurity incident that could have a material impact on our operations or financial results, we have implemented controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps taken to reduce vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to establishing information security policies and standards, implementing information protection processes and technologies, monitoring our information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with external organizations on cyber threat information and best practices. We have implemented a Cybersecurity Incident Response Procedure, which is integrated into our overall crisis management program. The procedure provides a plan for responding to cybersecurity incidents.

Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

Cybersecurity Governance

Risk Management teams within the CISO function, Business units, and support functions are responsible for identifying and assessing cybersecurity risks on an ongoing basis and establishing processes to ensure such potential cybersecurity risk exposures are monitored, and remediated through relevant cybersecurity controls.

Our cybersecurity process is defined and governed by our CISO function and implemented by our Chief Information Office (“CIO”) function. Our CISO has over 25 years of experience in the cybersecurity and technology industry, and reports to the Chief Operating Officer ("COO"). The CISO works closely with our CIO, who manages our information technology and security operations. The CISO and CIO have a set of responsibilities to govern and implement security policies and technology controls across the organization.

Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Audit, Risk and Compliance Committee of our Board has primary oversight responsibility for cybersecurity risks. The Audit, Risk and Compliance Committee regularly reviews and discusses the Company's cybersecurity framework and programs, the status of projects to strengthen our cybersecurity programs, results from third-party assessments, and any material cybersecurity incidents, including recent incidents at other companies and the emerging threat landscape, with our CISO, CIO, Chief Risk and Assurance Officer and COO. The Audit, Risk and Compliance Committee also reviews the implementation and effectiveness of the Company’s controls to monitor and mitigate cybersecurity risks with management. In addition, our Board of Directors receives an annual report, with quarterly written updates regarding our cybersecurity program and material security incident reports on need basis.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit, Risk and Compliance Committee of our Board has primary oversight responsibility for cybersecurity risks. The Audit, Risk and Compliance Committee regularly reviews and discusses the Company's cybersecurity framework and programs, the status of projects to strengthen our cybersecurity programs, results from third-party assessments, and any material cybersecurity incidents, including recent incidents at other companies and the emerging threat landscape, with our CISO, CIO, Chief Risk and Assurance Officer and COO. The Audit, Risk and Compliance Committee also reviews the implementation and effectiveness of the Company’s controls to monitor and mitigate cybersecurity risks with management.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] In addition, our Board of Directors receives an annual report, with quarterly written updates regarding our cybersecurity program and material security incident reports on need basis.
Cybersecurity Risk Role of Management [Text Block]

Risk Management teams within the CISO function, Business units, and support functions are responsible for identifying and assessing cybersecurity risks on an ongoing basis and establishing processes to ensure such potential cybersecurity risk exposures are monitored, and remediated through relevant cybersecurity controls.

Our cybersecurity process is defined and governed by our CISO function and implemented by our Chief Information Office (“CIO”) function. Our CISO has over 25 years of experience in the cybersecurity and technology industry, and reports to the Chief Operating Officer ("COO"). The CISO works closely with our CIO, who manages our information technology and security operations. The CISO and CIO have a set of responsibilities to govern and implement security policies and technology controls across the organization.

Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The CISO works closely with our CIO, who manages our information technology and security operations.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CISO has over 25 years of experience in the cybersecurity and technology industry, and reports to the Chief Operating Officer ("COO").
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]

Risk Management teams within the CISO function, Business units, and support functions are responsible for identifying and assessing cybersecurity risks on an ongoing basis and establishing processes to ensure such potential cybersecurity risk exposures are monitored, and remediated through relevant cybersecurity controls.

Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true