XML 65 R38.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We are committed to taking action to protect our information assets and systems. We have an enterprise-wide information security program designed to identify, protect against, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats, including those associated with our use of third-party service providers. We have installed privacy/security protection systems and devices on our network in an attempt to prevent cyberthreats and other unauthorized access to information. Additionally, we conduct security risk assessments prior to engaging third party suppliers and other vendors and business partners to validate that they maintain appropriate safeguards to protect our and their information systems in connection with services they provide. This risk assessment is heightened with respect to vendors or business partners that have access to our critical systems and information.

We have adopted an Information Security Policy applicable to all of our employees and business partners. We provide security awareness education and training for our employees annually, conduct regular internal “phishing” testing and mandatory training for “clickers,” and publish internal alerts to highlight any emerging or urgent security threats. We also maintain a Global Security Incident Response Plan (“GSIRP”) to guide our response in the event of a cyberattack or other form of network penetration. Our GSIRP is a cross functional plan that documents the details and decision-making processes required during a response to a security incident, as well as the reporting protocol with escalation timelines and responsibilities. We test our GSIRP with tabletop exercises administered by a third party security consultant. We leverage the standards set by the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework as well as industry best practices to measure our security posture and manage risk. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cyber issues, although our insurer may deny coverage for a future claim or our insurance coverage may be insufficient to cover all losses from a cyberattack.
We evaluate and manage risks relating to cybersecurity as part of our overall enterprise risk management program. We perform an annual assessment across the Company to identify and review potential risks. Risks are prioritized based on threat models to improve cybersecurity throughout the Company.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] We are committed to taking action to protect our information assets and systems. We have an enterprise-wide information security program designed to identify, protect against, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats, including those associated with our use of third-party service providers. We have installed privacy/security protection systems and devices on our network in an attempt to prevent cyberthreats and other unauthorized access to information. Additionally, we conduct security risk assessments prior to engaging third party suppliers and other vendors and business partners to validate that they maintain appropriate safeguards to protect our and their information systems in connection with services they provide. This risk assessment is heightened with respect to vendors or business partners that have access to our critical systems and information.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Our Board of Directors oversees our enterprise risk management program. The Audit Committee of our Board of Directors has the responsibility of exercising oversight with respect to our cybersecurity risk management and risk controls.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee of our Board of Directors has the responsibility of exercising oversight with respect to our cybersecurity risk management and risk controls.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Chief Information Officer provides periodic reports to the Audit Committee regarding our cybersecurity program, including our information risk management and oversight, security education and training, cyber threat detection and response processes, and relevant internal and industry cybersecurity attacks. The Board also receives a report out on cybersecurity issues and governance at least annually, with periodic updates as needed. Board members receive periodic presentations on cybersecurity topics from our Chief Information Officer and external experts as part of the Board’s continuing education on topics that impact public companies.
Cybersecurity Risk Role of Management [Text Block]
Our Senior Director of Information Security reports to our Chief Information Officer and is responsible for leading our enterprise-wide information security team. The team focuses on developing and implementing strategies, processes and response plans to protect the confidentiality, integrity, and availability of our assets. Our Senior Director of Information Security has prior experience as a chief information security officer and over 25 years of experience in Technology and Security. Our security team also includes members who maintain industry security certificates. Our team is additionally supported by third parties to assist in the operations of our program, compliance audits and security penetration testing.
Our Board of Directors oversees our enterprise risk management program. The Audit Committee of our Board of Directors has the responsibility of exercising oversight with respect to our cybersecurity risk management and risk controls. Our Chief Information Officer provides periodic reports to the Audit Committee regarding our cybersecurity program, including our information risk management and oversight, security education and training, cyber threat detection and response processes, and relevant internal and industry cybersecurity attacks. The Board also receives a report out on cybersecurity issues and governance at least annually, with periodic updates as needed. Board members receive periodic presentations on cybersecurity topics from our Chief Information Officer and external experts as part of the Board’s continuing education on topics that impact public companies.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our Board of Directors oversees our enterprise risk management program. The Audit Committee of our Board of Directors has the responsibility of exercising oversight with respect to our cybersecurity risk management and risk controls. Our Chief Information Officer provides periodic reports to the Audit Committee regarding our cybersecurity program, including our information risk management and oversight, security education and training, cyber threat detection and response processes, and relevant internal and industry cybersecurity attacks.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our Senior Director of Information Security has prior experience as a chief information security officer and over 25 years of experience in Technology and Security. Our security team also includes members who maintain industry security certificates.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our Chief Information Officer provides periodic reports to the Audit Committee regarding our cybersecurity program, including our information risk management and oversight, security education and training, cyber threat detection and response processes, and relevant internal and industry cybersecurity attacks. The Board also receives a report out on cybersecurity issues and governance at least annually, with periodic updates as needed.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true