XML 76 R34.htm IDEA: XBRL DOCUMENT v3.26.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We identify and address cybersecurity threats and risks related to our business using an interdisciplinary approach that includes assessments primarily by our management, IT team and legal department. To defend against, detect and respond to
cybersecurity incidents, we employ a multi-layered approach that has been integrated into our overall risk management systems and processes which includes, among other things: conducting proactive privacy and cybersecurity reviews of systems and applications, auditing applicable data policies, conducting employee training, monitoring emerging laws and regulations related to data protection and information security and continuously improving controls and implementing appropriate changes. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

The cybersecurity-control principles that form the basis of our cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework. Our management performs an annual review of third-party service providers’ SOC reports to verify appropriate controls are in place. Our Business Services segment undergoes an annual audit to ensure compliance with ISO 27001 controls.

In 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon. Despite our ongoing efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

Additionally, cybersecurity risks and threats that could have a material impact on the Company are discussed further in the Item 1A Risk Factors. Those sections of Item 1A should be read in conjunction with this Item 1C.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
We identify and address cybersecurity threats and risks related to our business using an interdisciplinary approach that includes assessments primarily by our management, IT team and legal department. To defend against, detect and respond to
cybersecurity incidents, we employ a multi-layered approach that has been integrated into our overall risk management systems and processes which includes, among other things: conducting proactive privacy and cybersecurity reviews of systems and applications, auditing applicable data policies, conducting employee training, monitoring emerging laws and regulations related to data protection and information security and continuously improving controls and implementing appropriate changes. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Cybersecurity is an important part of our risk management processes and is an area of focus for our board of directors and management. Our board of directors, as a whole, has oversight responsibility for our strategic and operational risks, and ensures that appropriate risk mitigation strategies are implemented by management. Our audit committee assists the board of directors with this responsibility by periodically reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of our management team, which is responsible for the assessment and management of cybersecurity risks.

In addition, we have retained an external consultant to serve as our internal audit function and to support our cybersecurity risk management and governance practices. Our consultant has substantial experience in cybersecurity risk management and information technology, including security, compliance, systems and programming and reports to our audit committee and our board of directors on any appropriate items.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our board of directors, as a whole, has oversight responsibility for our strategic and operational risks, and ensures that appropriate risk mitigation strategies are implemented by managemen
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
Cybersecurity is an important part of our risk management processes and is an area of focus for our board of directors and management. Our board of directors, as a whole, has oversight responsibility for our strategic and operational risks, and ensures that appropriate risk mitigation strategies are implemented by management. Our audit committee assists the board of directors with this responsibility by periodically reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of our management team, which is responsible for the assessment and management of cybersecurity risks.
Cybersecurity Risk Role of Management [Text Block]
The Global Director of Information Technology (GDIT) is the management position with primary responsibility for the development, operation, and maintenance of our information security program for the Business Services segment. The GDIT has over 25 years of experience as a security professional, and has completed the Prince 2 risk management certification at the practitioner level. Responsibilities of this role include management of third-party vendors, ensuring data interactions with outside parties, adhering to IT security best practices, and ensuring that all devices within the Business Services segment IT infrastructure are appropriately secured and managed. Responsibilities also encompass communication to senior management and future IT strategy and security planning for all segments, which may include outsourcing of certain responsibilities.
The Company’s compliance committee and counsel are informed of all security incidents and are tasked with ensuring appropriate remediation activities are implemented. Results of audits and material security incidents are presented to the Board of Directors on a quarterly basis.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Global Director of Information Technology (GDIT) is the management position with primary responsibility for the development, operation, and maintenance of our information security program for the Business Services segment. The GDIT has over 25 years of experience as a security professional, and has completed the Prince 2 risk management certification at the practitioner level. Responsibilities of this role include management of third-party vendors, ensuring data interactions with outside parties, adhering to IT security best practices, and ensuring that all devices within the Business Services segment IT infrastructure are appropriately secured and managed.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The GDIT has over 25 years of experience as a security professional, and has completed the Prince 2 risk management certification at the practitioner level.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Company’s compliance committee and counsel are informed of all security incidents and are tasked with ensuring appropriate remediation activities are implemented. Results of audits and material security incidents are presented to the Board of Directors on a quarterly basis.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true