XML 46 R28.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Apr. 30, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We integrate our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats into our enterprise risk management program based on recognized frameworks and applicable standards. Our cybersecurity program encompasses the key elements described below:
Collaboration. We employ a cross-functional, risk-based approach to identify and address anticipated and real-time threats to our cybersecurity. Our internal security, risk, and compliance personnel meet regularly to develop strategies for preserving the confidentiality, integrity and availability of corporate, customer, and other third-party information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents, if applicable, can be made in a timely manner.
Risk Assessment. At least annually, we conduct a cybersecurity risk assessment that takes into account information from our internal security, risk, and compliance functions, known information security vulnerabilities, and information from external sources, including reported security incidents that have affected other companies, industry trends, and evaluations by third parties and consultants. We also conduct risk-based cybersecurity tabletop exercises periodically to test our internal readiness and response planning.
Incident Response and Recovery Planning. Our cybersecurity program includes a dedicated cybersecurity function led by our Chief Information Security Officer (“CISO”). As part of our cybersecurity function, our Distributed Security Incident Response Team (“DSRT”) administers a program to monitor, detect, investigate, respond to, and escalate management of internal and external cybersecurity threats and incidents. The DSRT provides threat intelligence information from internal and external resources to our CISO, broader security and resiliency organization, and relevant business units and functional areas as one source within our risk assessment process. Our cybersecurity function partners closely with our Data Privacy organization, led by the Business Integrity Officer, and others within the Legal organization to ensure prompt response on data breach and any other regulatory notification requirements. We have incident response and recovery plans that we test and evaluate for effectiveness in accordance with industry standards.
Third-Party Risk Management. We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of certain third-party service providers. These providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in the risk assessments, including information supplied by providers and third parties. In addition, we require these providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers.
External Assessments. Our cybersecurity program is regularly assessed by consultants and third-party auditors. These assessments include information security maturity evaluations, audits, and independent reviews of our information security control environment and operating effectiveness. The results of significant assessments are reported to management, our board of directors, and our Audit Committee. We adjust our cybersecurity processes based on these results. We have obtained industry certifications and attestations that demonstrate our dedication to protecting the data our customers entrust to us. Information about such certifications can be found on our website.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] We integrate our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats into our enterprise risk management program based on recognized frameworks and applicable standards.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Our board of directors oversees the Company’s risk management process. It has delegated to our Audit Committee the primary responsibility for executing oversight of our cybersecurity risk management processes. In performing this role, the Audit Committee receives regular reports from our CISO and other members of management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. The Audit Committee also considers regular updates from management on our cybersecurity risk profile based on risk assessments, progress of risk reduction initiatives, third-party auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. The Audit Committee reports quarterly to our board of directors regarding the Audit Committee’s activities in overseeing cybersecurity risk management.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] It has delegated to our Audit Committee the primary responsibility for executing oversight of our cybersecurity risk management processes.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] In performing this role, the Audit Committee receives regular reports from our CISO and other members of management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. The Audit Committee also considers regular updates from management on our cybersecurity risk profile based on risk assessments, progress of risk reduction initiatives, third-party auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. The Audit Committee reports quarterly to our board of directors regarding the Audit Committee’s activities in overseeing cybersecurity risk management.
Cybersecurity Risk Role of Management [Text Block] Our cybersecurity program efforts are directed by our CISO who, with the support of the Chief Financial Officer, the Chief Product Officer, and the Chief Legal Officer, has the primary responsibility for assessing and managing material cybersecurity risks. The CISO along with these members of our management, acting as a group, drive alignment on security decisions across the Company. The CISO and various members of this group meet quarterly with the Audit Committee to review security performance metrics, identify security risks and review mitigation strategies, and assess the status of approved security enhancements. Our CISO has served in various roles in information technology, information security and risk management for over 28 years, including serving as the Information Security Officer and Chief Security Officer of multiple companies.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our cybersecurity program efforts are directed by our CISO who, with the support of the Chief Financial Officer, the Chief Product Officer, and the Chief Legal Officer, has the primary responsibility for assessing and managing material cybersecurity risks. The CISO along with these members of our management, acting as a group, drive alignment on security decisions across the Company. The CISO and various members of this group meet quarterly with the Audit Committee to review security performance metrics, identify security risks and review mitigation strategies, and assess the status of approved security enhancements.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CISO has served in various roles in information technology, information security and risk management for over 28 years, including serving as the Information Security Officer and Chief Security Officer of multiple companies.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our cybersecurity program efforts are directed by our CISO who, with the support of the Chief Financial Officer, the Chief Product Officer, and the Chief Legal Officer, has the primary responsibility for assessing and managing material cybersecurity risks. The CISO along with these members of our management, acting as a group, drive alignment on security decisions across the Company. The CISO and various members of this group meet quarterly with the Audit Committee to review security performance metrics, identify security risks and review mitigation strategies, and assess the status of approved security enhancements.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true