XML 46 R22.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We have established policies and processes designed to identify, assess, and mitigate cybersecurity risks. These policies and processes are intended to protect the confidentiality, integrity, and availability of our critical information systems and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature. They include the deployment of third-party security solutions and tools designed to monitor, identify, and address cybersecurity risks, as well as the development of an incident response plan informed by the National Institute of Standards and Technology (“NIST”) framework that is designed to identify and manage significant events that may impact our information technology infrastructure, including those arising from or related to cybersecurity threats. As part of our cybersecurity risk management, we conduct periodic risk assessments designed to identify reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. We also maintain risk-based processes to assess and review the cybersecurity practices of certain of our third-party vendors and services providers prior to onboarding, including through review of System and Organization (SOC) reports provided by potential vendors and the inclusion of security requirements in contracts, as appropriate. Employees are required to complete annual cybersecurity awareness training designed to raise awareness of cybersecurity threats. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future.
For more information about the risks from cybersecurity threats, see the risk factors entitled “Cybersecurity risks, including cyber-attacks, data breaches, and system vulnerabilities could adversely affect our business and disrupt our operations” and “An impairment of the confidentiality, integrity, or availability of our IT systems, or those of one or more of our IT vendors could have a material adverse effect on our business.”
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] These policies and processes are intended to protect the confidentiality, integrity, and availability of our critical information systems and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Our board of directors (“Board”) considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Audit Committee of the Board (the “Audit Committee”) oversight of cybersecurity matters, cybersecurity risk management, disclosure obligations with respect to cybersecurity incidents, and compliance with SEC rules applicable to cybersecurity risk management.
The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management will update the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee regularly reports to the full Board regarding its activities, including those related to cybersecurity risk.
Our Chief Information Security Officer (“CISO”), in connection with our IT personnel, is responsible for day-to-day implementation, management and evaluation of our cybersecurity risk assessment and management processes. This team has primary responsibility for our overall cybersecurity risk management program, including monitoring the detection, prevention, mitigation, and remediation of cybersecurity incidents, and works in partnership with our other business leaders, including our Chief Financial Officer and General Counsel. Our CISO supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our CISO has served in various roles in information technology and information security for over 30 years.
Our cybersecurity incident response process is designed to escalate significant cybersecurity incidents to a team of business leaders, including, but not limited to, our Chief Financial Officer and General Counsel. In the case of a cybersecurity incident, this team of business leaders will work with our incident response team to help determine the severity of the impact of a cybersecurity incident, as well as to help mitigate and remediate cybersecurity incidents of which they are notified. The incident response team will also work under the oversight of legal counsel and the Audit Committee to determine whether an incident is material for disclosure purposes under applicable law.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management will update the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee regularly reports to the full Board regarding its activities, including those related to cybersecurity risk.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Chief Information Security Officer (“CISO”), in connection with our IT personnel, is responsible for day-to-day implementation, management and evaluation of our cybersecurity risk assessment and management processes. This team has primary responsibility for our overall cybersecurity risk management program, including monitoring the detection, prevention, mitigation, and remediation of cybersecurity incidents, and works in partnership with our other business leaders, including our Chief Financial Officer and General Counsel. Our CISO supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our CISO has served in various roles in information technology and information security for over 30 years.
Cybersecurity Risk Role of Management [Text Block] Our board of directors (“Board”) considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Audit Committee of the Board (the “Audit Committee”) oversight of cybersecurity matters, cybersecurity risk management, disclosure obligations with respect to cybersecurity incidents, and compliance with SEC rules applicable to cybersecurity risk management.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our Chief Information Security Officer (“CISO”), in connection with our IT personnel, is responsible for day-to-day implementation, management and evaluation of our cybersecurity risk assessment and management processes.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CISO has served in various roles in information technology and information security for over 30 years.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management will update the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee regularly reports to the full Board regarding its activities, including those related to cybersecurity risk.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true