XML 86 R29.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We are committed to developing and maintaining cybersecurity policies and procedures that are designed to protect the Company against risks from continually evolving cybersecurity threats.
Our cybersecurity program maintains processes designed to identify, measure, and mitigate cybersecurity risks. These processes include internal semi-annual technical audits of existing cybersecurity controls, which are informed by industry standards and frameworks including, but not limited to, the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the Center for Internal Controls (CIS) critical security controls. These audits are informed by interviews with Company stakeholders to inform cybersecurity priorities.
Our cybersecurity program also includes external and internal penetration tests and vulnerability assessments. We also operate a bug bounty program to encourage proactive vulnerability reporting, and conduct employee training. Additionally, we take part in ongoing cybersecurity industry research and cybersecurity framework development.
We provide periodic updates on cybersecurity risk identification, assessment, and mitigation to executive management, the Audit Committee of the Board of Directors, and the full Board of Directors. Based on their feedback, and in combination with a continuous maturity self-assessment process, we make periodic personnel, processes, or technology adjustments for the cybersecurity program, as appropriate.
To address cybersecurity risks posed by third-party vendors, our cybersecurity program includes processes for third-party vendor risk assessment and management. Based on the sensitivity of the data involved and other business context, our vendor evaluation process may include technical assessments, questionnaires, market analysis, and reviewing references. Based on this information, vendors may be continuously monitored, and reassessments may be conducted on a periodic basis to evaluate ongoing compliance.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
We are committed to developing and maintaining cybersecurity policies and procedures that are designed to protect the Company against risks from continually evolving cybersecurity threats.
Our cybersecurity program maintains processes designed to identify, measure, and mitigate cybersecurity risks. These processes include internal semi-annual technical audits of existing cybersecurity controls, which are informed by industry standards and frameworks including, but not limited to, the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the Center for Internal Controls (CIS) critical security controls. These audits are informed by interviews with Company stakeholders to inform cybersecurity priorities.
Our cybersecurity program also includes external and internal penetration tests and vulnerability assessments. We also operate a bug bounty program to encourage proactive vulnerability reporting, and conduct employee training. Additionally, we take part in ongoing cybersecurity industry research and cybersecurity framework development.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Our Board of Directors holds ultimate responsibility for risk oversight, including cybersecurity. The CIO provides an annual cybersecurity update to the Board of Directors. Our Audit Committee, pursuant to its charter, has been tasked by our Board of Directors with oversight of cybersecurity risk management. The CIO and SVP of Security report to the Audit Committee on cybersecurity matters on a periodic basis.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Audit Committee, pursuant to its charter, has been tasked by our Board of Directors with oversight of cybersecurity risk management. The CIO and SVP of Security report to the Audit Committee on cybersecurity matters on a periodic basis.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
We provide periodic updates on cybersecurity risk identification, assessment, and mitigation to executive management, the Audit Committee of the Board of Directors, and the full Board of Directors. Based on their feedback, and in combination with a continuous maturity self-assessment process, we make periodic personnel, processes, or technology adjustments for the cybersecurity program, as appropriate.
Our Board of Directors holds ultimate responsibility for risk oversight, including cybersecurity. The CIO provides an annual cybersecurity update to the Board of Directors. Our Audit Committee, pursuant to its charter, has been tasked by our Board of Directors with oversight of cybersecurity risk management. The CIO and SVP of Security report to the Audit Committee on cybersecurity matters on a periodic basis.
Cybersecurity Risk Role of Management [Text Block]
Our cybersecurity program is directed by our Chief Information Officer (“CIO”), along with the Senior Vice President ("SVP") of Security, who oversees our Cyber Resilience Department. Our CIO has over twenty-five (25) years of experience in the information technology (“IT”) industry, where he has held various chief information officer and technology leadership roles, including as the chief information officer at a public technology company. Our SVP of Security also has over twenty-five (25) years of experience in the IT and information security industries, and previously served as the chief information security officer at a public technology company.
The CIO reports to senior management on the Company’s cybersecurity governance program. Our CIO and SVP of Security are members of our cyber resilience steering committee. This committee consists of leaders across the Company in the areas of information security, governance, and oversight. The committee meets periodically and as needed to, as relevant, discuss oversight of the Company’s cybersecurity program, program enhancements, and emerging cybersecurity risks or threats.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our cybersecurity program is directed by our Chief Information Officer (“CIO”), along with the Senior Vice President ("SVP") of Security, who oversees our Cyber Resilience Department.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CIO has over twenty-five (25) years of experience in the information technology (“IT”) industry, where he has held various chief information officer and technology leadership roles, including as the chief information officer at a public technology company. Our SVP of Security also has over twenty-five (25) years of experience in the IT and information security industries, and previously served as the chief information security officer at a public technology company.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The CIO reports to senior management on the Company’s cybersecurity governance program. Our CIO and SVP of Security are members of our cyber resilience steering committee. This committee consists of leaders across the Company in the areas of information security, governance, and oversight. The committee meets periodically and as needed to, as relevant, discuss oversight of the Company’s cybersecurity program, program enhancements, and emerging cybersecurity risks or threats.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true