XML 249 R34.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
As part of our Enterprise Risk Management (“ERM”) program, we maintain processes to assess, identify, manage, mitigate, and respond to material risks from cybersecurity threats. Central to these processes is a committee comprised of our Vice President of Internal Audit, our Chief Information Officer (“CIO”), members of our executive team, and other senior members of management that evaluates cybersecurity risks and designs and ensures implementation of appropriate controls, protections and training. This committee periodically reviews overall risks to the Company as part of the ERM program and ensures the alignment of cybersecurity efforts with the overall risk management framework. The committee has identified cybersecurity threats as one of the primary categories of risk to the Company.
Our information systems align with industry security standards. Our cybersecurity program, where appropriate, aligns with the Center of Internet Security (“CIS”) Control framework, which itself is modeled after the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework (“CSF”).
Our policies and procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, detect intrusions into our systems, and respond to cybersecurity incidents. We also regularly review our incident response and business continuity plans to ensure readiness if and when an incident does occur, and we test our incident response plan through tabletop exercises. Furthermore, we have established a cyber safety program which consists of a team of employees who concentrate on raising cybersecurity awareness in office and home-office environments to educate employees connected to the systems we use on how to identify and report security threats or breaches.
We continually evaluate cybersecurity risks on an ongoing basis as part of our overall risk management strategy. We assess and identify cybersecurity risks through periodic risk assessments, penetration testing, and vulnerability scans, among other procedures and practices. We also receive cybersecurity alerts and threat intelligence from our peers, government agencies, information sharing and analysis centers and cybersecurity-related groups or associations. These and other measures are used to evaluate cybersecurity risks in a timely manner and to allocate resources in alignment with the overall risk management program. In the event of an incident, we intend to follow our detailed incident response policy, which outlines the steps to be followed from incident detection to eradication, recovery and notification. In addition, we regularly engage various third-parties to assess or test our systems and processes to enhance our detection and management of cybersecurity risks or assist with implementation of our risk management strategies, including consultants who assist with assessing risks and information security experts who conduct tabletop exercises with participation from company management.
Our operations rely on third-party suppliers, vendors, software programs, hardware products, and network systems, including cloud-based technologies, and we have processes to identify and evaluate cybersecurity risks and incidents associated with certain identified third-party providers.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
As part of our Enterprise Risk Management (“ERM”) program, we maintain processes to assess, identify, manage, mitigate, and respond to material risks from cybersecurity threats. Central to these processes is a committee comprised of our Vice President of Internal Audit, our Chief Information Officer (“CIO”), members of our executive team, and other senior members of management that evaluates cybersecurity risks and designs and ensures implementation of appropriate controls, protections and training. This committee periodically reviews overall risks to the Company as part of the ERM program and ensures the alignment of cybersecurity efforts with the overall risk management framework. The committee has identified cybersecurity threats as one of the primary categories of risk to the Company.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Our Board of Directors (the “Board”) maintains principal oversight responsibility for our ERM program. This oversight is facilitated primarily through the Audit Committee of the Board of Directors, which is responsible for oversight of our cybersecurity risk management processes. The chairman of our Audit Committee has earned a CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors, which aids the Audit Committee’s understanding of cybersecurity risks and assists the Audit Committee in overseeing the risk management program.
The Audit Committee and the Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. Senior leadership, including our CIO, briefs the Board of Directors and the Audit Committee on cybersecurity risks and the effectiveness of our cybersecurity program as part of updates on our overall ERM program. Our Vice President of Internal Audit also provides the Audit Committee with an assessment of any material changes to cybersecurity risks and controls as a result of cybersecurity threats on at least a semi-annual basis.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Audit Committee
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Management is responsible for assessing and managing our cybersecurity risk management program. We have various teams and committees charged with monitoring risks, implementing controls, developing information security policies and procedures, and assessing cyber events. In addition to our Information Technology ("IT") department, we have an Information Security ("IS") department that provides oversight of our cybersecurity-related controls, including assistance in the development of related policies and procedures. The IT department is overseen by an Chief Technology Officer ("CTO") who has a degree in networking as well as significant experience in the development, operation, monitoring and management of information system operations, including but not to limited to cybersecurity oriented controls. The IS department is overseen by a Senior Cybersecurity Manager who holds a Master of Science degree and has varied experience in the field of information technology. Both the IT and IS departments report to the CIO, who holds various certifications in systems and cybersecurity methodologies and has over two decades of experience in the management of various aspects of information systems operations. The CIO approves the information security policies and procedures, implementation of controls, monitoring and detection programs, and employee training on cybersecurity risks. The CIO also is responsible for reporting on cybersecurity matters to the Board.
Cybersecurity Risk Role of Management [Text Block]
Management’s Role in Assessing and Managing Material Risks from Cybersecurity Threats
Management is responsible for assessing and managing our cybersecurity risk management program. We have various teams and committees charged with monitoring risks, implementing controls, developing information security policies and procedures, and assessing cyber events. In addition to our Information Technology ("IT") department, we have an Information Security ("IS") department that provides oversight of our cybersecurity-related controls, including assistance in the development of related policies and procedures. The IT department is overseen by an Chief Technology Officer ("CTO") who has a degree in networking as well as significant experience in the development, operation, monitoring and management of information system operations, including but not to limited to cybersecurity oriented controls. The IS department is overseen by a Senior Cybersecurity Manager who holds a Master of Science degree and has varied experience in the field of information technology. Both the IT and IS departments report to the CIO, who holds various certifications in systems and cybersecurity methodologies and has over two decades of experience in the management of various aspects of information systems operations. The CIO approves the information security policies and procedures, implementation of controls, monitoring and detection programs, and employee training on cybersecurity risks. The CIO also is responsible for reporting on cybersecurity matters to the Board.
IT and/or IS inform the CIO concerning cybersecurity risks and events, including any mitigation and remediation efforts. Cybersecurity incidents are escalated to an incident response team (“IRT”), which is headed by the CIO. The IRT is responsible for overseeing our incident response strategy, including remediation. For ongoing events, those responsible for investigating the incident are required to continuously update the IRT and the CIO until the event is considered to be resolved. Significant
cybersecurity incidents are referred to a committee responsible for evaluating whether the incident is material using criteria based on our ERM program. This committee is comprised of a cross functional team of various senior members of management including the areas of Finance, Accounting, Legal, IT Security, and Risk.
If a cybersecurity incident is deemed to have the potential for a material impact on the Company, our Incident Response, Reporting and Management Policy dictates procedures for promptly briefing the Audit Committee. In addition, our CIO reports all cybersecurity incidents, whether ongoing or first experienced during the quarter, to the Audit Committee at each quarterly meeting, and more frequently if necessary.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] In addition to our Information Technology ("IT") department, we have an Information Security ("IS") department that provides oversight of our cybersecurity-related controls, including assistance in the development of related policies and procedures. The IT department is overseen by an Chief Technology Officer ("CTO") who has a degree in networking as well as significant experience in the development, operation, monitoring and management of information system operations, including but not to limited to cybersecurity oriented controls. The IS department is overseen by a Senior Cybersecurity Manager who holds a Master of Science degree and has varied experience in the field of information technology. Both the IT and IS departments report to the CIO, who holds various certifications in systems and cybersecurity methodologies and has over two decades of experience in the management of various aspects of information systems operations. The CIO approves the information security policies and procedures, implementation of controls, monitoring and detection programs, and employee training on cybersecurity risks. The CIO also is responsible for reporting on cybersecurity matters to the Board.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The IT department is overseen by an Chief Technology Officer ("CTO") who has a degree in networking as well as significant experience in the development, operation, monitoring and management of information system operations, including but not to limited to cybersecurity oriented controls. The IS department is overseen by a Senior Cybersecurity Manager who holds a Master of Science degree and has varied experience in the field of information technology. Both the IT and IS departments report to the CIO, who holds various certifications in systems and cybersecurity methodologies and has over two decades of experience in the management of various aspects of information systems operations.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
Management is responsible for assessing and managing our cybersecurity risk management program. We have various teams and committees charged with monitoring risks, implementing controls, developing information security policies and procedures, and assessing cyber events. In addition to our Information Technology ("IT") department, we have an Information Security ("IS") department that provides oversight of our cybersecurity-related controls, including assistance in the development of related policies and procedures. The IT department is overseen by an Chief Technology Officer ("CTO") who has a degree in networking as well as significant experience in the development, operation, monitoring and management of information system operations, including but not to limited to cybersecurity oriented controls. The IS department is overseen by a Senior Cybersecurity Manager who holds a Master of Science degree and has varied experience in the field of information technology. Both the IT and IS departments report to the CIO, who holds various certifications in systems and cybersecurity methodologies and has over two decades of experience in the management of various aspects of information systems operations. The CIO approves the information security policies and procedures, implementation of controls, monitoring and detection programs, and employee training on cybersecurity risks. The CIO also is responsible for reporting on cybersecurity matters to the Board.
IT and/or IS inform the CIO concerning cybersecurity risks and events, including any mitigation and remediation efforts. Cybersecurity incidents are escalated to an incident response team (“IRT”), which is headed by the CIO. The IRT is responsible for overseeing our incident response strategy, including remediation. For ongoing events, those responsible for investigating the incident are required to continuously update the IRT and the CIO until the event is considered to be resolved. Significant
cybersecurity incidents are referred to a committee responsible for evaluating whether the incident is material using criteria based on our ERM program. This committee is comprised of a cross functional team of various senior members of management including the areas of Finance, Accounting, Legal, IT Security, and Risk.
If a cybersecurity incident is deemed to have the potential for a material impact on the Company, our Incident Response, Reporting and Management Policy dictates procedures for promptly briefing the Audit Committee. In addition, our CIO reports all cybersecurity incidents, whether ongoing or first experienced during the quarter, to the Audit Committee at each quarterly meeting, and more frequently if necessary.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true