XML 56 R35.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Cybersecurity Risk Management and Strategy
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our information systems and the data we process, store, and transmit.
We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and NIST 800-171 r.2. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST CSF and NIST 800-171 r.2 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
Our cybersecurity risk management program is integrated into our overall risk management program. Our cybersecurity risk management program is intended to address cybersecurity risks across our business, including risks related to data protection, system availability, and operational continuity.
Key elements of our cybersecurity risk management program include, among other things:
Risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information, and other vulnerabilities, such as monitoring processes intended to detect security events.
Policies and procedures governing information security and acceptable use, including an incident response plan designed to enable timely escalation, containment, remediation, and reporting of cybersecurity incidents.
Administrative and technical safeguards designed to protect our information systems.
A third‑party risk management process for key service providers in connection with certain business operations, including providers of information technology, cloud‑based services, and other operational services. We maintain processes intended to assess and manage cybersecurity risks associated with these third‑party service providers based on our assessment of their criticality to our operations and respective risk profile.
Cybersecurity awareness training of our employees, including incident response personnel, and senior management. Our IT and cybersecurity teams regularly update training with newer modules to facilitate timely and relevant awareness, as well as to aid in better individual engagement with the training.
The use of external third‑party service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes.
A technical security architecture consisting of controls to identify, protect, detect, and respond to cybersecurity events.
A security team principally responsible for managing our cybersecurity risk assessment processes, security controls, and response to cybersecurity incidents.
Cybersecurity insurance to help mitigate the risk of a catastrophic cyber event.
We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information contained therein.
From time to time, we may experience cybersecurity incidents consistent with the nature of our business and industry. As of the date of this Annual Report, we are not aware of any cybersecurity incident that has materially affected, or that is reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.
While we believe our cybersecurity program is designed to manage risks from cybersecurity threats, no system is completely immune from attack, and we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item A, “Risk Factors – Any significant failure of, disruption in, or unauthorized access to or use of, our computer systems or those of third parties that we utilize in our operations, including those arising from
cyberattacks, could result in a loss or degradation of service, unauthorized processing of data, or theft or tampering of intellectual property, any of which could materially adversely impact our business and financial conditions.”
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and NIST 800-171 r.2. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST CSF and NIST 800-171 r.2 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
Our cybersecurity risk management program is integrated into our overall risk management program. Our cybersecurity risk management program is intended to address cybersecurity risks across our business, including risks related to data protection, system availability, and operational continuity.
Key elements of our cybersecurity risk management program include, among other things:
Risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information, and other vulnerabilities, such as monitoring processes intended to detect security events.
Policies and procedures governing information security and acceptable use, including an incident response plan designed to enable timely escalation, containment, remediation, and reporting of cybersecurity incidents.
Administrative and technical safeguards designed to protect our information systems.
A third‑party risk management process for key service providers in connection with certain business operations, including providers of information technology, cloud‑based services, and other operational services. We maintain processes intended to assess and manage cybersecurity risks associated with these third‑party service providers based on our assessment of their criticality to our operations and respective risk profile.
Cybersecurity awareness training of our employees, including incident response personnel, and senior management. Our IT and cybersecurity teams regularly update training with newer modules to facilitate timely and relevant awareness, as well as to aid in better individual engagement with the training.
The use of external third‑party service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes.
A technical security architecture consisting of controls to identify, protect, detect, and respond to cybersecurity events.
A security team principally responsible for managing our cybersecurity risk assessment processes, security controls, and response to cybersecurity incidents.
Cybersecurity insurance to help mitigate the risk of a catastrophic cyber event.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Cybersecurity Governance and Oversight
Our cybersecurity program is led by our VP of IT and Cybersecurity at the direction of our Chief Administrative Officer. The VP of IT and Cybersecurity has primary responsibility for our overall cybersecurity risk management program, supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants and has more than twenty years of experience in cybersecurity and cyber risk management along with an ISACA Certified Information Security Manager (CISM) designation. He is responsible for implementing cybersecurity policies, standards, and controls, coordinating incident response activities, and informing senior leadership on cybersecurity related issues and activities that are affecting the organization. The VP of IT and Cybersecurity works with the IT and Cybersecurity teams to implement appropriate controls and processes across the organization.
Our Board of Directors exercises oversight of cybersecurity risks and receives regular updates necessary to enable informed oversight of cybersecurity risks. The Board has also delegated primary responsibility for overseeing cybersecurity risk management to the Audit Committee, including oversight of management’s implementation of our cybersecurity risk management program, with support from our Nominating and Governance Committee of the Board. Management provides periodic updates to the Board or the Audit Committee regarding cybersecurity risks, significant threat developments, and, where it deems appropriate, cybersecurity incidents it considers to be significant or potentially significant. In addition, the Audit Committee considers cybersecurity risks in connection with its financial and compliance risk oversight role and receives updates on cybersecurity risks and key initiatives for mitigating those risks from the VP of IT and Cybersecurity and Chief Financial Officer (CFO). Board members also receive presentations on cybersecurity topics from our VP of IT and Cybersecurity and CFO, internal security staff or external experts as part of the Board’s continuing education on topics that impact public companies.
Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our cybersecurity program is led by our VP of IT and Cybersecurity at the direction of our Chief Administrative Officer.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The VP of IT and Cybersecurity has primary responsibility for our overall cybersecurity risk management program, supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants and has more than twenty years of experience in cybersecurity and cyber risk management along with an ISACA Certified Information Security Manager (CISM) designation. He is responsible for implementing cybersecurity policies, standards, and controls, coordinating incident response activities, and informing senior leadership on cybersecurity related issues and activities that are affecting the organization. The VP of IT and Cybersecurity works with the IT and Cybersecurity teams to implement appropriate controls and processes across the organization.
Cybersecurity Risk Role of Management [Text Block]
Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
Our cybersecurity program is led by our VP of IT and Cybersecurity at the direction of our Chief Administrative Officer. The VP of IT and Cybersecurity has primary responsibility for our overall cybersecurity risk management program, supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants and has more than twenty years of experience in cybersecurity and cyber risk management along with an ISACA Certified Information Security Manager (CISM) designation. He is responsible for implementing cybersecurity policies, standards, and controls, coordinating incident response activities, and informing senior leadership on cybersecurity related issues and activities that are affecting the organization. The VP of IT and Cybersecurity works with the IT and Cybersecurity teams to implement appropriate controls and processes across the organization.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Management provides periodic updates to the Board or the Audit Committee regarding cybersecurity risks, significant threat developments, and, where it deems appropriate, cybersecurity incidents it considers to be significant or potentially significant.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true