XML 52 R35.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Risk Management and Strategy
The Company maintains a robust enterprise-wide information security program aimed at assessing, identifying, and effectively managing cybersecurity risks, threats, and incidents. The Company has integrated cybersecurity risk management into its broader risk management framework to promote cybersecurity risk management company-wide.
Third-Party Engagement
The Company engages a range of third-party advisory service providers, including cybersecurity assessors, and consultants to conduct recurrent evaluations of its cybersecurity controls. These reviews are a critical component of the ongoing risk assessment process within the cybersecurity function and include periodic evaluations of internal controls aimed at mitigating cybersecurity threats. These assessments often include penetration tests, evaluations of the Company's cyber program maturity, and assessments of progress toward future-state cyber initiatives, among other considerations. The results of these assessments are reviewed with management and the Board.
Oversee Third-party Risk
The Company implements processes to oversee and manage the risks inherent with third-party service providers, including conducting thorough security assessments prior to engagement. This is designed to mitigate risks related to data breaches or other security incidents originating from third party providers.
Incident Response
The Company has implemented internal incident response procedures to address potential cyber incidents. These procedures are designed to analyze, contain, and remediate any cyber incidents that may circumvent existing safeguards. The incident response procedures encompass a systematic approach to evaluate the materiality of incidents, execute appropriate containment and remediation measures, and evaluate internal (including the Board) and external communication and disclosure protocols. The Company also maintains data backup procedures in the event of a cybersecurity incident and for a business continuity plan in the event of business interruption. Examples of our backup procedures include regularly scheduled backups for various systems, critical system log files, and applications backup.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
The Company maintains a robust enterprise-wide information security program aimed at assessing, identifying, and effectively managing cybersecurity risks, threats, and incidents. The Company has integrated cybersecurity risk management into its broader risk management framework to promote cybersecurity risk management company-wide.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]
Impact of Cybersecurity Threats
As previously disclosed, we have experienced significant cyber incidents in the past, including in April 2023, that have impacted our operations and financial results. The related expense is reflected in “Acquisition, cyber incident, and other, net” on the Consolidated Statements of Operations for the year ended December 31, 2023, and any reserve balance is included in “Accounts payable and accrued expenses” in our Consolidated Balance Sheets as of December 31, 2024, and 2023. For additional information regarding such risks and the affects thereof on our business strategy, operations and financial condition, see Part I, Item 1A, Risk Factors – “We depend on information technology systems to operate our business. A failure of our information technology systems, cybersecurity attacks or a breach of our information security systems, networks or processes could cause business disruptions and the loss of confidential information and may materially adversely affect our business.”
Cybersecurity Risk Board of Directors Oversight [Text Block]
Governance & Board Oversight
The cybersecurity program is led by the Company’s Chief Information Security Officer (“CISO”). The CISO plays a pivotal role in informing the Board on cybersecurity risks.
Management, including the CISO, provides comprehensive briefings to the Board on cybersecurity risks at least quarterly. These briefings encompass a range of topics, including the current cybersecurity landscape and emerging threats, status of ongoing cybersecurity initiatives and strategies, incident reports, and compliance with regulatory requirements and industry standards. Additionally, the Board is regularly briefed on updates related to the Company’s Global Information Security Program and the Company’s Information Security Roadmap. The Board also oversees the prompt assessment of material cyber events including countermeasures and mitigation actions.
In addition to scheduled meetings, the Board and CISO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks and updates on any significant developments in the cybersecurity domain.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
The cybersecurity program is led by the Company’s Chief Information Security Officer (“CISO”). The CISO plays a pivotal role in informing the Board on cybersecurity risks.
Management, including the CISO, provides comprehensive briefings to the Board on cybersecurity risks at least quarterly. These briefings encompass a range of topics, including the current cybersecurity landscape and emerging threats, status of ongoing cybersecurity initiatives and strategies, incident reports, and compliance with regulatory requirements and industry standards. Additionally, the Board is regularly briefed on updates related to the Company’s Global Information Security Program and the Company’s Information Security Roadmap. The Board also oversees the prompt assessment of material cyber events including countermeasures and mitigation actions.
In addition to scheduled meetings, the Board and CISO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks and updates on any significant developments in the cybersecurity domain.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
The cybersecurity program is led by the Company’s Chief Information Security Officer (“CISO”). The CISO plays a pivotal role in informing the Board on cybersecurity risks.
Management, including the CISO, provides comprehensive briefings to the Board on cybersecurity risks at least quarterly. These briefings encompass a range of topics, including the current cybersecurity landscape and emerging threats, status of ongoing cybersecurity initiatives and strategies, incident reports, and compliance with regulatory requirements and industry standards. Additionally, the Board is regularly briefed on updates related to the Company’s Global Information Security Program and the Company’s Information Security Roadmap. The Board also oversees the prompt assessment of material cyber events including countermeasures and mitigation actions.
In addition to scheduled meetings, the Board and CISO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks and updates on any significant developments in the cybersecurity domain.
Cybersecurity Risk Role of Management [Text Block]
Management’s Role Managing Risk
The Americold Global Information Security Program is structured to address cyber-related risks in alignment with the guidelines delineated in the National Institute of Standards and Technology (“NIST”) security framework. The program also leverages various automated tools, manual processes, and routine periodic third-party assessments to promote the efficacy of our security measures. Furthermore, the program includes a formal information security training program for that includes comprehensive security awareness initiatives and training modules, addressing critical areas such as phishing attacks and best practices for email security.
The Company’s Chief Information Officer (“CIO”) and CISO work closely with other management positions, including the Chief Financial Officer, Chief Legal Officer, and the Head of Internal Audit, to evaluate cybersecurity risks in alignment with our business objectives and operational needs. The CIO oversees the Company’s security team and the CISO and has participated in the NIST review and validation of security procedures and processes.
The individuals responsible for evaluating and managing the Company’s cybersecurity risk have extensive experience managing organizational risk and implementing cybersecurity programs at companies. The CIO has more than 20 years of experience advising on the overall strategy of technology, including the incorporation of cyber security into the software development lifecycle and change management process. The CISO possesses more than 10 years of relevant expertise in cybersecurity and holds a Certified Information Systems Security Professional (“CISSP”) certification. Other members of the Company’s information security team also hold certifications such as CISSP, Certified Information Security Manager (“CISM”), Certified Ethical Hacker (“CEH”), and Certified Information Systems Auditor (“CISA”). The Chief Financial Officer has experience assessing and managing material financial risks, including cybersecurity risks, and serving on the Disclosure Committee at public companies. The Chief Legal Officer possesses many years of experience managing legal and compliance risk at public companies, including with respect to cybersecurity incidents. The Head of Internal Audit manages the Company’s broader risk management framework, which includes cybersecurity risks, and has many years of prior experience assessing cybersecurity risks and programs at several companies.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Americold Global Information Security Program is structured to address cyber-related risks in alignment with the guidelines delineated in the National Institute of Standards and Technology (“NIST”) security framework. The program also leverages various automated tools, manual processes, and routine periodic third-party assessments to promote the efficacy of our security measures.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Americold Global Information Security Program is structured to address cyber-related risks in alignment with the guidelines delineated in the National Institute of Standards and Technology (“NIST”) security framework. The program also leverages various automated tools, manual processes, and routine periodic third-party assessments to promote the efficacy of our security measures.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Americold Global Information Security Program is structured to address cyber-related risks in alignment with the guidelines delineated in the National Institute of Standards and Technology (“NIST”) security framework. The program also leverages various automated tools, manual processes, and routine periodic third-party assessments to promote the efficacy of our security measures.