XML 97 R32.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] Strategy: We maintain a Cybersecurity Strategy, or CSS, which emphasizes consideration of the nature of our business, ongoing intelligence collection regarding cybersecurity threats, and initiatives to specifically address prominent areas of cybersecurity risk. The CSS outlines the key priorities for our cybersecurity program and the methods by which our Information Security department seeks to accomplish those goals.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] We maintain a Cybersecurity Strategy, or CSS, which emphasizes consideration of the nature of our business, ongoing intelligence collection regarding cybersecurity threats, and initiatives to specifically address prominent areas of cybersecurity risk.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Governance and Leadership: Our Board of Directors is responsible for overseeing our risk management process, which includes management of general risks as well as specific risks, such as those relating to cybersecurity, facing our business. The Risk Committee of our Board of Directors has been delegated the primary responsibility for overseeing management’s identification and mitigation of cybersecurity risk. The Risk Committee is composed of board members with diverse expertise including cybersecurity, risk management, technology, business operations, regulatory and finance. The Risk Committee receives presentations on at least a quarterly basis from our Chief Information Security Officer, or CISO, and senior members of the Enterprise Risk Management, or ERM, team, and the Chair of the Risk Committee provides reports to the full Board of Directors following such presentations. Our Information Security department is led by our CISO, who, in addition to quarterly presentations to the Risk Committee of our Board of Directors, also provides comprehensive reports to a dedicated internal governance committee at least quarterly outlining threat assessment, control performance, and ongoing enhancements. Our current CISO has served in the role since September 2021 and leads the cybersecurity program across our regulated futures and options exchanges, CCPs, trade repositories, equities venues, systemically important financial market utilities (SIFMUs) and our data services network and mortgage technology platforms. Prior to joining ICE, our CISO served as CISO of the White House Military Office and as CISO for two technology companies, and has more than 20 years of experience in cybersecurity, national security, and intelligence. Additionally, cybersecurity matters are reported to and discussed with a cross-subsidiary leadership committee and subsidiary boards. The Cyber Threat Intelligence team monitors multiple cybersecurity intelligence sources and curates the applicable data. In the event we identify a cybersecurity threat applicable to us, we have a process to evaluate, escalate to Senior Management and respond to the threat faced. In addition, our CISO and other senior security leaders conduct periodic cybersecurity education sessions with our employees and directors. These sessions cover general cybersecurity topics as well as specific details regarding our cybersecurity program.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Board of Directors is responsible for overseeing our risk management process, which includes management of general risks as well as specific risks, such as those relating to cybersecurity, facing our business. The Risk Committee of our Board of Directors has been delegated the primary responsibility for overseeing management’s identification and mitigation of cybersecurity risk. The Risk Committee is composed of board members with diverse expertise including cybersecurity, risk management, technology, business operations, regulatory and finance.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Risk Committee receives presentations on at least a quarterly basis from our Chief Information Security Officer, or CISO, and senior members of the Enterprise Risk Management, or ERM, team, and the Chair of the Risk Committee provides reports to the full Board of Directors following such presentations.
Cybersecurity Risk Role of Management [Text Block] Risk Management: Cybersecurity risk management is integrated into our broader ERM framework. Our cybersecurity leadership team, in concert with our ERM team, assesses threats and risks at least annually through the Enterprise Technology Risk Assessment process, which includes threat objective inherent risk score determination, identification of key and supporting controls, and resulting residual threat objective risk scores. Additionally, thematic threats such as sabotage, fraud, and theft of assets or customer data are used to frame our risk management activities. Asset theft often involves organized crime or financially motivated nations staging sophisticated, well-planned campaigns to steal significant cash, cryptocurrency, or equivalent assets. Our thematic threats, along with others, are evaluated by our Board of Directors as well as our Risk Committee, Corporate Risk Officer and our CISO. The CSS provides the framework we use for assessing risk, prioritizing testing, identifying remedial actions and validating improvements. The CSS also provides for the deployment of external and internal teams of ethical hackers that operate alongside our traditional vulnerability detection processes.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our Board of Directors is responsible for overseeing our risk management process, which includes management of general risks as well as specific risks, such as those relating to cybersecurity, facing our business. The Risk Committee of our Board of Directors has been delegated the primary responsibility for overseeing management’s identification and mitigation of cybersecurity risk. The Risk Committee is composed of board members with diverse expertise including cybersecurity, risk management, technology, business operations, regulatory and finance. The Risk Committee receives presentations on at least a quarterly basis from our Chief Information Security Officer, or CISO, and senior members of the Enterprise Risk Management, or ERM, team, and the Chair of the Risk Committee provides reports to the full Board of Directors following such presentations. Our Information Security department is led by our CISO, who, in addition to quarterly presentations to the Risk Committee of our Board of Directors, also provides comprehensive reports to a dedicated internal governance committee at least quarterly outlining threat assessment, control performance, and ongoing enhancements
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our current CISO has served in the role since September 2021 and leads the cybersecurity program across our regulated futures and options exchanges, CCPs, trade repositories, equities venues, systemically important financial market utilities (SIFMUs) and our data services network and mortgage technology platforms. Prior to joining ICE, our CISO served as CISO of the White House Military Office and as CISO for two technology companies, and has more than 20 years of experience in cybersecurity, national security, and intelligence.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Additionally, cybersecurity matters are reported to and discussed with a cross-subsidiary leadership committee and subsidiary boards. The Cyber Threat Intelligence team monitors multiple cybersecurity intelligence sources and curates the applicable data. In the event we identify a cybersecurity threat applicable to us, we have a process to evaluate, escalate to Senior Management and respond to the threat faced. In addition, our CISO and other senior security leaders conduct periodic cybersecurity education sessions with our employees and directors. These sessions cover general cybersecurity topics as well as specific details regarding our cybersecurity program.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true