XML 51 R35.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We have a cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats. This includes compliance with the Enterprise Information Security Policy (“EISP”) established by BN.
We believe our cybersecurity program is reasonably designed to materially protect the integrity and availability of our information and technology. This program addresses security governance, security awareness, employee training, relevant access and end-point security, vulnerability management, penetration testing, security monitoring and incident response. We use technologies to optimize our security risk detection and response capabilities, in addition to access controls and anti-malware protections. We believe our practices align with the National Institute of Standards and Technology Cybersecurity Framework in meeting and exceeding the industry average in cybersecurity practice.
In addition, all employees regularly undergo mandatory continuing cybersecurity and data protection training. Employees in higher-risk functions receive additional training and cybersecurity awareness education. We continue to focus on readying our assets by implementing a standard way to test the systems of our portfolio companies annually through cyber readiness drills. These drills consist of simulations of potential threats in which companies need to detect, protect against, and recover from an attack. Audits, cybersecurity simulations and employee testing results indicate that our program is effective in protecting our information. The policies, standards, and guidance are structured to help our company respond effectively to the dynamically changing environment of cybersecurity threats, cybersecurity risks, technologies, laws, and regulations. Our group modifies its policies, standards, and guidance as needed to adjust to this changing environment.
The effectiveness of these programs is evaluated regularly through both internal and third-party audits.
In 2023, we undertook the following initiatives: further enhanced our data protection and threat-intelligence capabilities; improved our processes for third-party risk management; continued mandatory cybersecurity education for all employees; and incorporated social engineering to our phishing simulations. When we engage third parties, we have policies and processes to govern their access and reduce the risks associated with their access. For example, all third-party access must be authorized and have a legitimate business need. Prior to authorization and granting access, the terms and conditions of such access must be agreed to as part of a formal agreement or contract. In addition, all authorized third-party access must be limited, monitored and controlled as appropriate.
Data privacy and cybersecurity are one element of our comprehensive approach to strong corporate governance and risk management practices, which also focuses on corporate governance ethics; our board of directors; ethical business conduct; supply chain and vendor management; and human rights and modern slavery.
Our systems face cybersecurity risks, and we have in the past experienced threats to our data and systems. However, to date, these incidents have not had a material impact on our business strategy, results of operations, or financial condition. We can provide no assurance that we will not experience any material cybersecurity threats or incidents in the future. See “Item 3D. Risk Factors— Our business relies on the use of technology, and as a result, we may be exposed to cyber-security attacks”.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
We have a cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats. This includes compliance with the Enterprise Information Security Policy (“EISP”) established by BN.
We believe our cybersecurity program is reasonably designed to materially protect the integrity and availability of our information and technology. This program addresses security governance, security awareness, employee training, relevant access and end-point security, vulnerability management, penetration testing, security monitoring and incident response. We use technologies to optimize our security risk detection and response capabilities, in addition to access controls and anti-malware protections. We believe our practices align with the National Institute of Standards and Technology Cybersecurity Framework in meeting and exceeding the industry average in cybersecurity practice.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Cybersecurity at our company is overseen by our board of directors, the Audit Committee and management, as well as by BN, through the EISP described above.
The Audit Committee of our board of directors is responsible for overseeing risk management strategies that are specific to our company, including reviewing management’s assessment of the current and emerging risks and related mitigation strategies across financial and non-financial risks, including cybersecurity risks. Regular reports and updates on cybersecurity risks are made to senior management of the Service Providers and the respective board of directors of our portfolio companies.
Pursuant to the EISP, BN’s executive management has appointed a Chief Information Security Officer (“the CISO”) who works closely with BN’s senior management, legal counsel and external counsel to develop and monitor BN’s data protection, privacy and cybersecurity program and policies, including such policies that apply to our company. The CISO provides periodic reports to the audit committee of BN, which subsequently reports to the board of directors of BN about data protection and cybersecurity risks and issues.
In addition, BN has established a Cybersecurity Committee, led by the CISO, and composed of representatives from BN’s operating businesses, including our group. The Cybersecurity Committee meets quarterly to discuss cybersecurity risks, emerging technologies and associated risks, and security initiatives at Brookfield and its operating businesses.
The CISO has over 20 years’ experience in cybersecurity oversight and the remaining Cybersecurity Committee members have an average of approximately 7 years of cybersecurity experience.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee of our board of directors is responsible for overseeing risk management strategies that are specific to our company, including reviewing management’s assessment of the current and emerging risks and related mitigation strategies across financial and non-financial risks, including cybersecurity risks.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
The Audit Committee of our board of directors is responsible for overseeing risk management strategies that are specific to our company, including reviewing management’s assessment of the current and emerging risks and related mitigation strategies across financial and non-financial risks, including cybersecurity risks. Regular reports and updates on cybersecurity risks are made to senior management of the Service Providers and the respective board of directors of our portfolio companies.
Cybersecurity Risk Role of Management [Text Block]
Cybersecurity at our company is overseen by our board of directors, the Audit Committee and management, as well as by BN, through the EISP described above.
The Audit Committee of our board of directors is responsible for overseeing risk management strategies that are specific to our company, including reviewing management’s assessment of the current and emerging risks and related mitigation strategies across financial and non-financial risks, including cybersecurity risks. Regular reports and updates on cybersecurity risks are made to senior management of the Service Providers and the respective board of directors of our portfolio companies.
Pursuant to the EISP, BN’s executive management has appointed a Chief Information Security Officer (“the CISO”) who works closely with BN’s senior management, legal counsel and external counsel to develop and monitor BN’s data protection, privacy and cybersecurity program and policies, including such policies that apply to our company. The CISO provides periodic reports to the audit committee of BN, which subsequently reports to the board of directors of BN about data protection and cybersecurity risks and issues.
In addition, BN has established a Cybersecurity Committee, led by the CISO, and composed of representatives from BN’s operating businesses, including our group. The Cybersecurity Committee meets quarterly to discuss cybersecurity risks, emerging technologies and associated risks, and security initiatives at Brookfield and its operating businesses.
The CISO has over 20 years’ experience in cybersecurity oversight and the remaining Cybersecurity Committee members have an average of approximately 7 years of cybersecurity experience.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] CISO”) who works closely with BN’s senior management, legal counsel and external counsel to develop and monitor BN’s data protection, privacy and cybersecurity program and policies, including such policies that apply to our company. The CISO provides periodic reports to the audit committee of BN, which subsequently reports to the board of directors of BN about data protection and cybersecurity risks and issues.
In addition, BN has established a Cybersecurity Committee, led by the CISO, and composed of representatives from BN’s operating businesses, including our group. The Cybersecurity Committee meets quarterly to discuss cybersecurity risks, emerging technologies and associated risks, and security initiatives at Brookfield and its operating businesses.
The CISO has over 20 years’ experience in cybersecurity oversight and the remaining Cybersecurity Committee members have an average of approximately 7 years of cybersecurity experience.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]
The CISO has over 20 years’ experience in cybersecurity oversight and the remaining Cybersecurity Committee members have an average of approximately 7 years of cybersecurity experience.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The CISO provides periodic reports to the audit committee of BN, which subsequently reports to the board of directors of BN about data protection and cybersecurity risks and issues.
In addition, BN has established a Cybersecurity Committee, led by the CISO, and composed of representatives from BN’s operating businesses, including our group. The Cybersecurity Committee meets quarterly to discuss cybersecurity risks, emerging technologies and associated risks, and security initiatives at Brookfield and its operating businesses.
The CISO has over 20 years’ experience in cybersecurity oversight and the remaining Cybersecurity Committee members have an average of approximately 7 years of cybersecurity experience.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true