XML 82 R24.htm IDEA: XBRL DOCUMENT v3.26.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We have implemented a comprehensive risk management framework, which includes policies and procedures designed for assessing, identifying, and managing material cybersecurity threats and facilitating timely disclosure of material cybersecurity incidents. Our security approach is built on three core principles: defense in depth (layered security), least privilege access, and a risk-based approach that prioritizes security resources based on risk assessment.
Our policies require mandatory annual cybersecurity awareness training for all employees, focusing on phishing and social engineering recognition and reporting, among other areas. We evaluate potential security risks and conduct routine incident response tabletop exercises to practice responding to realistic cybersecurity incident and data breach scenarios. We undertake annual reviews of our policies, which are designed to help ensure their effectiveness and relevance in light of evolving cybersecurity threats. We have also implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, including by reviewing evidence that their systems meet appropriate cybersecurity requirements for key service providers. We collaborate with our service providers to understand developments within their cybersecurity framework and to seek to ensure service providers notify us promptly of
cybersecurity threats or incidents that may affect our systems or data. Additionally, we maintain cyber insurance to help cover costs associated with cybersecurity events and to provide access to a panel of approved incident response partners, including forensics and incident response firms, law firms, breach notification providers, public relations firms, and distributed denial-of-service mitigation services.
We also engage third parties to assist in our cybersecurity mitigation and detection efforts, including a managed service provider ("MSP") that provides, among other things, cybersecurity monitoring and threat detection through a Security Information and Event Management system, security assessments and penetration testing, and Virtual Chief Information Security Officer services. The MSP operates as an extension of our Corporate Strategy professionals, who, as discussed below, manage the Company’s information technology and cybersecurity risk management initiatives, and is bound by the same security and confidentiality obligations as the Company’s employees.
Our incident response and data breach procedures apply to all employees, contractors, and third-party users and are designed to provide a comprehensive, structured response to cybersecurity threats and incidents. Upon receiving an incident report, Corporate Strategy and our MSP perform an initial assessment to determine severity level, whether escalation to executive leadership is needed, and whether cyber insurance notification and approved partner engagement is required. For potentially significant cybersecurity incidents, we engage insurance-approved partners based on the nature and scope of the incident, and Corporate Strategy coordinates with our executive leadership to manage the incident response, investigation, notification, and remediation process.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] We have implemented a comprehensive risk management framework, which includes policies and procedures designed for assessing, identifying, and managing material cybersecurity threats and facilitating timely disclosure of material cybersecurity incidents.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Our board of directors, in coordination with our Audit Committee, oversees our risk management process, including cybersecurity risks. The Audit Committee receives regular reports from our executive leadership and our Vice President of Corporate Strategy on the threat landscape and the Company’s cybersecurity program.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
Our board of directors, in coordination with our Audit Committee, oversees our risk management process, including cybersecurity risks. The Audit Committee receives regular reports from our executive leadership and our Vice President of Corporate Strategy on the threat landscape and the Company’s cybersecurity program.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
Our board of directors, in coordination with our Audit Committee, oversees our risk management process, including cybersecurity risks. The Audit Committee receives regular reports from our executive leadership and our Vice President of Corporate Strategy on the threat landscape and the Company’s cybersecurity program.
Cybersecurity Risk Role of Management [Text Block]
Our Corporate Strategy department manages the Company's information technology operations and cybersecurity risk management and is responsible for receiving incident reports, performing initial assessments, coordinating approved partner engagement, leading investigations, overseeing remediation, and managing communications related to cybersecurity incidents. The Vice President of Corporate Strategy, who is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks, has significant experience in information technology and possesses the requisite education, skills, and experience expected of an individual assigned to these duties. Our executive leadership, including our Chief Executive Officer, Chief Financial Officer, Chief Risk Officer, and Chief Legal Officer, provides oversight of our cybersecurity risk management program and receives regular updates from the Vice President of Corporate Strategy.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Vice President of Corporate Strategy, who is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks, has significant experience in information technology and possesses the requisite education, skills, and experience expected of an individual assigned to these duties.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Vice President of Corporate Strategy, who is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks, has significant experience in information technology and possesses the requisite education, skills, and experience expected of an individual assigned to these duties.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
Our Corporate Strategy department manages the Company's information technology operations and cybersecurity risk management and is responsible for receiving incident reports, performing initial assessments, coordinating approved partner engagement, leading investigations, overseeing remediation, and managing communications related to cybersecurity incidents. The Vice President of Corporate Strategy, who is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks, has significant experience in information technology and possesses the requisite education, skills, and experience expected of an individual assigned to these duties. Our executive leadership, including our Chief Executive Officer, Chief Financial Officer, Chief Risk Officer, and Chief Legal Officer, provides oversight of our cybersecurity risk management program and receives regular updates from the Vice President of Corporate Strategy.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true