XML 114 R39.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
The Company has a cybersecurity risk program that is based on industry standards and best practices managed by a dedicated staff and specialists that support this program. We have implemented a set of system, network and application-level controls to protect our corporate data and systems. These controls are monitored for cybersecurity risk events and incidents on a continuous basis by a dedicated staff of cybersecurity professionals and various third-party providers. These controls are updated as necessary to protect the Company. In addition, the Company also takes a proactive approach by monitoring cyber threat intelligence to stay informed regarding emerging risks. The cybersecurity risk program also utilizes third-party assessors, consultants and auditors to perform various services, such as tabletop exercises and network penetration tests. The Company provides awareness training to its employees to help identify, avoid and mitigate cybersecurity threats. Employees with network access participate quarterly in required training, including spear phishing and other awareness training. The program also has a policy in place to address vendor and third-party risk. Cybersecurity risk is also evaluated during the acquisition process for new products and services.
The Company accounts for cybersecurity risk as a part of the Company's overall business strategy and planning. The Board's Audit Committee, which oversees all matters related to risk management and, in particular, the security of and risks related to the Company's information technology systems, receives regular reports on the Company's cybersecurity risk management efforts from various senior officers of the Company. The Company also has a corporate cybersecurity risk Steering Committee, which is a cross-functional group comprised of both senior management and other key business unit leaders that provides input to senior management on the Company's cybersecurity risk program.
The Company has not experienced any material operational or financial impact as the result of a cybersecurity risk or incident and, at this time, the risks from cybersecurity threats are not reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. However, it is prepared to mitigate and respond to such an event should it occur. The Company has prepared a comprehensive Cybersecurity Incident Response Plan, as well as an Information Technology Disaster Recovery Plan. These plans are reviewed, updated and tested on a regular basis. Specifically, the Company conducts cybersecurity tabletop exercises that include participation by Audit Committee members, senior management and third-party cybersecurity consultants.
The Company faces a range of cybersecurity threats including threats common to many industries, such as ransomware and denial of service, as well as more advanced threats specific to critical infrastructure industries such as mining. The Company's customers, equipment suppliers, transportation facility providers and joint venture partners face similar cybersecurity threats, and a cybersecurity incident affecting the Company or any of these entities could materially affect our operations, performance and results of operations. The Company continues to invest in the cybersecurity and resiliency of its networks and to enhance its internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity, please see the section titled “Risk Factors - Terrorist attacks or cyber incidents could result in information theft, data corruption, operational disruption and/or financial loss.”
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
The Company has a cybersecurity risk program that is based on industry standards and best practices managed by a dedicated staff and specialists that support this program. We have implemented a set of system, network and application-level controls to protect our corporate data and systems. These controls are monitored for cybersecurity risk events and incidents on a continuous basis by a dedicated staff of cybersecurity professionals and various third-party providers. These controls are updated as necessary to protect the Company. In addition, the Company also takes a proactive approach by monitoring cyber threat intelligence to stay informed regarding emerging risks. The cybersecurity risk program also utilizes third-party assessors, consultants and auditors to perform various services, such as tabletop exercises and network penetration tests. The Company provides awareness training to its employees to help identify, avoid and mitigate cybersecurity threats. Employees with network access participate quarterly in required training, including spear phishing and other awareness training. The program also has a policy in place to address vendor and third-party risk. Cybersecurity risk is also evaluated during the acquisition process for new products and services.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
The Company's Board of Directors has assigned oversight of cybersecurity risk to the Audit Committee, as outlined in the Committee's charter. Updates on the cybersecurity risk program are provided at each Audit Committee meeting. Additionally, the Company's senior management engages with the Audit Committee on a regular basis to provide updates on our cybersecurity risk program.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
The Company's Board of Directors has assigned oversight of cybersecurity risk to the Audit Committee, as outlined in the Committee's charter. Updates on the cybersecurity risk program are provided at each Audit Committee meeting. Additionally, the Company's senior management engages with the Audit Committee on a regular basis to provide updates on our cybersecurity risk program.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
The Company has a Cybersecurity Manager who reports directly to the Director of Information Technology. The Company's Cybersecurity Manager has 25 years of industry experience and holds many relevant industry certifications. The Cybersecurity Manager has direct oversight of the cybersecurity risk program. Cybersecurity risk briefings are provided to the Audit Committee by the Director of Information Technology at all regular meetings. Additionally, the Director of Information Technology and Cybersecurity Manager communicate directly with the Audit Committee chair as needed to ensure adequate oversight of the program.
Cybersecurity Risk Role of Management [Text Block]
The Company's Board of Directors has assigned oversight of cybersecurity risk to the Audit Committee, as outlined in the Committee's charter. Updates on the cybersecurity risk program are provided at each Audit Committee meeting. Additionally, the Company's senior management engages with the Audit Committee on a regular basis to provide updates on our cybersecurity risk program.
The Company has a Cybersecurity Manager who reports directly to the Director of Information Technology. The Company's Cybersecurity Manager has 25 years of industry experience and holds many relevant industry certifications. The Cybersecurity Manager has direct oversight of the cybersecurity risk program. Cybersecurity risk briefings are provided to the Audit Committee by the Director of Information Technology at all regular meetings. Additionally, the Director of Information Technology and Cybersecurity Manager communicate directly with the Audit Committee chair as needed to ensure adequate oversight of the program.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
The Company has a Cybersecurity Manager who reports directly to the Director of Information Technology. The Company's Cybersecurity Manager has 25 years of industry experience and holds many relevant industry certifications. The Cybersecurity Manager has direct oversight of the cybersecurity risk program. Cybersecurity risk briefings are provided to the Audit Committee by the Director of Information Technology at all regular meetings. Additionally, the Director of Information Technology and Cybersecurity Manager communicate directly with the Audit Committee chair as needed to ensure adequate oversight of the program.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]
The Company has a Cybersecurity Manager who reports directly to the Director of Information Technology. The Company's Cybersecurity Manager has 25 years of industry experience and holds many relevant industry certifications. The Cybersecurity Manager has direct oversight of the cybersecurity risk program. Cybersecurity risk briefings are provided to the Audit Committee by the Director of Information Technology at all regular meetings. Additionally, the Director of Information Technology and Cybersecurity Manager communicate directly with the Audit Committee chair as needed to ensure adequate oversight of the program.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
The Company's Board of Directors has assigned oversight of cybersecurity risk to the Audit Committee, as outlined in the Committee's charter. Updates on the cybersecurity risk program are provided at each Audit Committee meeting. Additionally, the Company's senior management engages with the Audit Committee on a regular basis to provide updates on our cybersecurity risk program.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true