XML 53 R31.htm IDEA: XBRL DOCUMENT v3.25.3
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Sep. 30, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including, among other things, intellectual property, trade secrets, confidential information that is proprietary, strategic or competitive in nature, and personal data.
Our Chief Information Officer (“CIO”) together with our Senior Director of IT Infrastructure, Security and Compliance and other members of the Information and Business Technology (“IBT”) Security team, are responsible for establishing and implementing cybersecurity policies and procedures, which includes developing and updating our Security Incident Response Policy (“IRP”), managing incident response, and overseeing any policy exceptions and potential compensating controls.
Our cybersecurity program is based on the ISO 27001 security controls. We maintain an ISO 27001:2022 certification and we undergo routine audits by an independent, certified accreditation body to maintain this certification. We also provide annual, mandatory cybersecurity training for employees to equip our workforce with the knowledge to identify and respond to cybersecurity threats, such as phishing attempts.
Our process for assessing, identifying, and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management process. As part of our overall enterprise risk management process, we have a cybersecurity risk management strategy based on National Institute of Standards and Technology (NIST) Special Publication. 800-30 “Guide for Conducting Risk Assessments” that provide guidelines and principles for information technology security risk management.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
Our process for assessing, identifying, and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management process. As part of our overall enterprise risk management process, we have a cybersecurity risk management strategy based on National Institute of Standards and Technology (NIST) Special Publication. 800-30 “Guide for Conducting Risk Assessments” that provide guidelines and principles for information technology security risk management.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
The Board oversees management’s processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our CIO regularly briefs the Board on cybersecurity matters. We have procedures led by our CIO which govern our assessment, response and notification of internal and external parties upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our executive team, to evaluate the overall impact and appropriate or required external notifications. Based on its nature and severity, the Board would be informed of an incident by our executive team.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Board oversees management’s processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Our CIO regularly briefs the Board on cybersecurity matters. We have procedures led by our CIO which govern our assessment, response and notification of internal and external parties upon the occurrence of a cybersecurity incident.
Cybersecurity Risk Role of Management [Text Block]
Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate. Management, including the CIO, is involved in assessing and managing our cybersecurity risks. Our CIO has 14 years of experience managing information technology in complex environments. As noted above, the company’s IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CIO, who then informs the Board based on the nature and severity of the incident. The company’s incident response team also coordinates with external legal advisors, cybersecurity forensic firms, communication specialists, and other outside advisors and experts, as appropriate.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate. Management, including the CIO, is involved in assessing and managing our cybersecurity risks. Our CIO has 14 years of experience managing information technology in complex environments. As noted above, the company’s IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CIO, who then informs the Board based on the nature and severity of the incident.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CIO has 14 years of experience managing information technology in complex environments. As noted above, the company’s IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CIO, who then informs the Board based on the nature and severity of the incident.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] As noted above, the company’s IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CIO, who then informs the Board based on the nature and severity of the incident. The company’s incident response team also coordinates with external legal advisors, cybersecurity forensic firms, communication specialists, and other outside advisors and experts, as appropriate.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true