XML 45 R31.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Cybersecurity Risk Management and Strategy
The Company’s risk management program is headed by its Chief Information Officer and Cybersecurity Architect. Collectively, they possess a diverse portfolio of highly regarded cybersecurity certifications, including certifications with a focus on risk management, and are able to leverage their extensive cybersecurity experience to effectively manage risk. The Company’s information technology (“IT”) team is led by the Company’s Chief Information Officer, and employs dedicated security staff who hold well-established cybersecurity certifications. The Company’s IT team meets on a recurring basis, and at least quarterly, with senior members of the Information Technology, Compliance, and Internal Audit departments to assess cybersecurity risks. Additionally, our employees and certain consultants are required to complete cybersecurity training during onboarding and on an annual basis to reinforce awareness of cybersecurity threats and risks to the organization.
In addition to internal resources, the Company engages third parties to help test and evaluate the effectiveness and resiliency of the Company’s IT environment, including annual penetration testing, weekly vulnerability scanning, periodic security audits of cloud environments and quarterly phishing simulations. These engagements provide recommendations to strengthen the program, and provide updates on leading cybersecurity protections and practices.
The Company assesses cybersecurity risk through a process based on the cybersecurity framework established by the U.S. National Institute of Standards and Technology (NIST). Each year, the Company’s IT team conducts a series of sessions to discuss and evaluate risks and ranks the potential severity and likelihood of each identified risk, as well as the current and planned controls to mitigate such risks informed by the NIST Risk Management Framework. Based upon this
analysis, a formal cybersecurity risk register is maintained to identify, track and treat cybersecurity risk, and project plans are developed to prioritize and allocate resources effectively, which are then discussed with key members of management, including the Company’s Chief Executive Officer, and approved by the Company’s Data Protection Team (“DPT”). The DPT consists of the Company’s Chief Information Officer, Chief Financial Officer, Chief Operating Officer, Chief Compliance Officer, Head of Internal Audit and Chief Legal Officer.
Among the risks assessed is the risk of a cybersecurity incident at a third-party service provider. To evaluate and manage this risk, the cybersecurity team conducts due diligence in connection with onboarding new vendors and performs annual due diligence with our key third-party vendors. Our due diligence process includes inquiries regarding risk management, human resources security, physical and environmental security, compliance, business continuity and contractual obligations. We also seek to collect cybersecurity audit reports and other supporting documentation for review. In addition, we have processes in place to evaluate the potential impact to our IT networks and systems when we learn of a significant cybersecurity event, including contacting our key vendors to determine if they were impacted and if Company data was compromised.
The Company also evaluates cybersecurity risks associated with emerging technologies, including the use of artificial intelligence tools and implements policies and controls to mitigate associated risks.
The Company deploys a range of technical safeguards designed to protect its information systems from cybersecurity threats. These safeguards include layered network and endpoint protections such as firewalls, intrusion detection and prevention mechanisms and advanced endpoint security technologies. The Company also maintains identity and access controls based on identity-centric, least-privilege access controls and continuous verification principles, utilizing centralized security monitoring and alerting capabilities to identify and respond to anomalous activity. Additional controls include multi-factor authentication, privileged access management, mobile device management with encryption and compliance enforcement and data loss prevention capabilities to protect sensitive information. The Company maintains continuous vulnerability management and patch management processes designed to remediate identified vulnerabilities in a timely manner and enforces device compliance as a condition of access to corporate resources.
In addition to the foregoing, the Company’s Internal Audit team assesses the design and test the effectiveness of cyber controls, and annually, as part of its internal controls testing, performs a review of service auditor reports for in-scope application vendors.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
The Company assesses cybersecurity risk through a process based on the cybersecurity framework established by the U.S. National Institute of Standards and Technology (NIST). Each year, the Company’s IT team conducts a series of sessions to discuss and evaluate risks and ranks the potential severity and likelihood of each identified risk, as well as the current and planned controls to mitigate such risks informed by the NIST Risk Management Framework. Based upon this
analysis, a formal cybersecurity risk register is maintained to identify, track and treat cybersecurity risk, and project plans are developed to prioritize and allocate resources effectively, which are then discussed with key members of management, including the Company’s Chief Executive Officer, and approved by the Company’s Data Protection Team (“DPT”). The DPT consists of the Company’s Chief Information Officer, Chief Financial Officer, Chief Operating Officer, Chief Compliance Officer, Head of Internal Audit and Chief Legal Officer.
The Company also evaluates cybersecurity risks associated with emerging technologies, including the use of artificial intelligence tools and implements policies and controls to mitigate associated risks.
The Company deploys a range of technical safeguards designed to protect its information systems from cybersecurity threats. These safeguards include layered network and endpoint protections such as firewalls, intrusion detection and prevention mechanisms and advanced endpoint security technologies. The Company also maintains identity and access controls based on identity-centric, least-privilege access controls and continuous verification principles, utilizing centralized security monitoring and alerting capabilities to identify and respond to anomalous activity. Additional controls include multi-factor authentication, privileged access management, mobile device management with encryption and compliance enforcement and data loss prevention capabilities to protect sensitive information. The Company maintains continuous vulnerability management and patch management processes designed to remediate identified vulnerabilities in a timely manner and enforces device compliance as a condition of access to corporate resources.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
The Company’s board of directors (“Board”) is responsible for overseeing and monitoring our risk management processes, including cybersecurity-related risks. The Board is assisted in its oversight responsibilities by the standing Board committees, and the audit committee of the Board (“Audit Committee”) is responsible for overseeing our cybersecurity risks. Our Chief Information Officer provides cybersecurity updates and reviews the Company’s cybersecurity risks and protection measures with either the Audit Committee or the full Board on at least a semi-annual basis. Topics covered in such meetings have included (i) results of quarterly phishing simulation tests, (ii) results from cybersecurity audits and penetration testing, (iii) review and enhancements to policies (including the Incident Response and Business Continuity policies) and (iv) any recent, significant cybersecurity incidents. The Board and Audit Committee also engage in regular discussions regarding cybersecurity risk management with the Company’s senior management, internal auditors and independent auditors.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Company’s board of directors (“Board”) is responsible for overseeing and monitoring our risk management processes, including cybersecurity-related risks.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Board is assisted in its oversight responsibilities by the standing Board committees, and the audit committee of the Board (“Audit Committee”) is responsible for overseeing our cybersecurity risks. Our Chief Information Officer provides cybersecurity updates and reviews the Company’s cybersecurity risks and protection measures with either the Audit Committee or the full Board on at least a semi-annual basis. Topics covered in such meetings have included (i) results of quarterly phishing simulation tests, (ii) results from cybersecurity audits and penetration testing, (iii) review and enhancements to policies (including the Incident Response and Business Continuity policies) and (iv) any recent, significant cybersecurity incidents. The Board and Audit Committee also engage in regular discussions regarding cybersecurity risk management with the Company’s senior management, internal auditors and independent auditors.
Cybersecurity Risk Role of Management [Text Block] In addition to the foregoing, the Company’s Internal Audit team assesses the design and test the effectiveness of cyber controls, and annually, as part of its internal controls testing, performs a review of service auditor reports for in-scope application vendors.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Board is assisted in its oversight responsibilities by the standing Board committees, and the audit committee of the Board (“Audit Committee”) is responsible for overseeing our cybersecurity risks.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Collectively, they possess a diverse portfolio of highly regarded cybersecurity certifications, including certifications with a focus on risk management, and are able to leverage their extensive cybersecurity experience to effectively manage risk.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our Chief Information Officer provides cybersecurity updates and reviews the Company’s cybersecurity risks and protection measures with either the Audit Committee or the full Board on at least a semi-annual basis.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true