XML 46 R28.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
The Company recognizes the increasing complexity and significance of cybersecurity risks in safeguarding its technology, operations, and customer data. As an advanced electric vehicle manufacturer, the Company’s operations rely on interconnected digital infrastructure, cloud-based systems, and proprietary software platforms, making cybersecurity an essential component of its risk management framework.
The Company has implemented a comprehensive cybersecurity program designed to identify, assess, mitigate, and respond to cybersecurity risks. This approach is informed by industry best practices, including the NIST Cybersecurity Framework (“CSF”) and Risk Management Framework (“RMF”). The program is designed to prevent disruptions to operations, protect critical assets, and ensure compliance with applicable regulations such as the California Consumer Privacy Act (“CCPA”), the General Data Protection Regulation (“GDPR”), and the Securities and Exchange Commission (“SEC”) cybersecurity disclosure requirements.
The following disclosure outlines the Company’s cybersecurity risk management strategy, governance structure, incident response procedures, regulatory compliance efforts, and ongoing investments in cybersecurity.
1. Cybersecurity Risk Management
The Company employs a structured cybersecurity risk management program that aligns with NIST CSF's five core functions: Identify, Protect, Detect, Respond, and Recover. The approach includes:
•Risk Assessments: Regular evaluations of cyber risks across IT infrastructure, production systems, and cloud-based platforms.
•Threat Detection and Monitoring: Deployment of Security Information and Event Management (SIEM) tools, intrusion detection systems, and endpoint security solutions to monitor cyber threats in real-time.
•Third-Party Risk Management: Continuous evaluation of vendors and partners who have access to the Company’s sensitive data and operational networks.
•Access Controls and Encryption: Implementation of multi-factor authentication (MFA), data encryption protocols, and network segmentation to reduce attack vectors.
The Company integrates cybersecurity into its enterprise risk management (ERM) framework to ensure cyber threats are regularly evaluated as part of its business strategy and operational resilience efforts.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
The Company has implemented a comprehensive cybersecurity program designed to identify, assess, mitigate, and respond to cybersecurity risks. This approach is informed by industry best practices, including the NIST Cybersecurity Framework (“CSF”) and Risk Management Framework (“RMF”). The program is designed to prevent disruptions to operations, protect critical assets, and ensure compliance with applicable regulations such as the California Consumer Privacy Act (“CCPA”), the General Data Protection Regulation (“GDPR”), and the Securities and Exchange Commission (“SEC”) cybersecurity disclosure requirements.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Cybersecurity oversight is a shared responsibility between the Company’s Board of Directors, senior management, and IT security leadership. The Board receives regular updates on cybersecurity risk exposure, incident response capabilities, and compliance efforts from management.
The Company’s Senior Cybersecurity Engineer leads the execution of cybersecurity programs, including:
•Developing and maintaining security policies.
•Conducting periodic risk assessments and audits.
•Managing incident response and recovery plans.
•Providing reports to senior executives on security trends, vulnerabilities, and ongoing mitigation efforts.
The Company enforces a top-down approach to cybersecurity governance, ensuring accountability and continuous risk monitoring at all levels of the organization.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
Cybersecurity oversight is a shared responsibility between the Company’s Board of Directors, senior management, and IT security leadership. The Board receives regular updates on cybersecurity risk exposure, incident response capabilities, and compliance efforts from management.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] o Board members currently hold formal cybersecurity certifications or direct experience in cybersecurity risk management. The Company continues to enhance Board education on cybersecurity trends and governance practices.
Cybersecurity Risk Role of Management [Text Block]
Management plays an active role in implementing cybersecurity policies, conducting risk evaluations, and ensuring compliance with regulatory requirements. The IT security team collaborates with third-party cybersecurity vendors, including Rapid7, Cisco, and Carbon Black, to enhance the Company’s security posture.
Management is also responsible for employee training and awareness programs, ensuring that cybersecurity is embedded in the corporate culture. All employees complete mandatory cybersecurity training to recognize and mitigate phishing attempts, malware threats, and social engineering risks.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
Management plays an active role in implementing cybersecurity policies, conducting risk evaluations, and ensuring compliance with regulatory requirements. The IT security team collaborates with third-party cybersecurity vendors, including Rapid7, Cisco, and Carbon Black, to enhance the Company’s security posture.
Management is also responsible for employee training and awareness programs, ensuring that cybersecurity is embedded in the corporate culture. All employees complete mandatory cybersecurity training to recognize and mitigate phishing attempts, malware threats, and social engineering risks.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]
Management plays an active role in implementing cybersecurity policies, conducting risk evaluations, and ensuring compliance with regulatory requirements. The IT security team collaborates with third-party cybersecurity vendors, including Rapid7, Cisco, and Carbon Black, to enhance the Company’s security posture.
Management is also responsible for employee training and awareness programs, ensuring that cybersecurity is embedded in the corporate culture. All employees complete mandatory cybersecurity training to recognize and mitigate phishing attempts, malware threats, and social engineering risks.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
Management plays an active role in implementing cybersecurity policies, conducting risk evaluations, and ensuring compliance with regulatory requirements. The IT security team collaborates with third-party cybersecurity vendors, including Rapid7, Cisco, and Carbon Black, to enhance the Company’s security posture.
Management is also responsible for employee training and awareness programs, ensuring that cybersecurity is embedded in the corporate culture. All employees complete mandatory cybersecurity training to recognize and mitigate phishing attempts, malware threats, and social engineering risks.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true