XML 52 R31.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Our cybersecurity program is managed by a dedicated Global Chief Information Officer ("CIO") whose team, including the head of Information Technology Security, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our CIO has over 35 years of relevant industry experience, including over 30 years at our Company. Our Vice President of Information Technology Security and Chief Information Security Officer ("CISO") has over 20 years of relevant industry experience. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming, as well as cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager. Our Board, Audit Committee and its Technology Subcommittee and senior management receive periodic briefings from the CIO and the CISO, concerning cybersecurity, information security and technology risks, and our related risk mitigation programs. In general, the Board is responsible for overseeing our enterprise risk management program ("ERM Program").
The ERM Program is a proactive and ongoing process led by our legal and risk professionals and senior management, to identify, assess and manage risks and to build out and track mitigation and reduction efforts. The Board has tasked the Audit Committee with overseeing, reviewing and discussing with management, the internal audit team and the independent auditors, our ERM Program, policies and procedures with respect to, among other things, the assessment and management of risks related to our cybersecurity and information security and the steps management has taken to monitor and control such risks.
The Audit Committee and its Technology Subcommittee are also responsible for overseeing risks related to our cybersecurity, technology and information security programs and reviewing emerging cybersecurity, technology and information security developments and threats and our strategy to mitigate such risks. The Audit Committee and its Technology Subcommittee provides another level of cybersecurity oversight through engagements at each Technology Subcommittee meeting with senior management, including our CIO and CISO. These reports include updates on our cybersecurity risks, threats, and incidents; our efforts to monitor, prevent, detect, mitigate and remediate the same; regulatory updates; the status of our cybersecurity projects, programs, and assessments; and periodic updates on our cybersecurity staffing and related matters. The Technology Subcommittee regularly reports to the Audit Committee regarding these matters. Further, the Audit Committee regularly reports to the Board regarding these matters, including the matters discussed at the Technology Subcommittee.
We engage in the ERM Program process semi-annually, which addresses, among other matters, emerging cybersecurity threats and models our exposure to the threat landscape against the overall strategic objectives of our Company. We regularly engage cybersecurity industry experts to assess, audit and consult on our cybersecurity practices. Further, we engage Managed Security Service Providers to monitor our information technology ("IT") environment, help identify attacks, forensically investigate and remediate breaches, and assess and test our IT system security. We also operate a cyber controls assessment program to monitor our internal program in between external assessments. We have also implemented a cybersecurity awareness training program to facilitate initial and continuing education for employees on cybersecurity and related matters. Regular reviews are conducted to assess our information security programs and practices, including incident management, service continuity, information security compliance programs and related achievements. Additionally, we operate an Artificial Intelligence ("AI") governance program to ensure proper risk management and regulatory compliance where applicable with this expanding capability; managing ethical, legal, cyber, data privacy and other technology risks associated with the use of AI and Generative AI technologies.
In addition, we operate a third-party cyber risk management capability which monitors the exposure of significant IT suppliers, significant software as a service suppliers and major vendors with access to our IT systems. We also monitor for significant changes in our cybersecurity risk posture and attempt to remediate the risk through collaboration with that partner. We also monitor for known breaches of the IT supplier landscape.
As previously disclosed, during March 2021, we experienced a systems outage that was caused by a cybersecurity incident. We engaged leading forensic information technology firms and legal counsel to assist our investigation into the incident and we restored our systems. Despite these actions, we experienced delays and disruptions to our business, including brewery operations, production and shipments. This incident caused a shift in production and shipments from the first quarter of 2021 to the balance of fiscal year 2021. In addition, we incurred certain incremental one-time costs of $2.4 million for the year ended December 31, 2021, related to consultants, experts and data recovery efforts, net of insurance recoveries. See also Part I—Item 1A Risk Factors for the following risk: Cybersecurity incidents impacting our information systems, and violations of data privacy laws and regulations could disrupt our business operations and adversely impact our reputation and results of operations.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] The ERM Program is a proactive and ongoing process led by our legal and risk professionals and senior management, to identify, assess and manage risks and to build out and track mitigation and reduction efforts. The Board has tasked the Audit Committee with overseeing, reviewing and discussing with management, the internal audit team and the independent auditors, our ERM Program, policies and procedures with respect to, among other things, the assessment and management of risks related to our cybersecurity and information security and the steps management has taken to monitor and control such risks.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Our cybersecurity program is managed by a dedicated Global Chief Information Officer ("CIO") whose team, including the head of Information Technology Security, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our CIO has over 35 years of relevant industry experience, including over 30 years at our Company. Our Vice President of Information Technology Security and Chief Information Security Officer ("CISO") has over 20 years of relevant industry experience. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming, as well as cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager. Our Board, Audit Committee and its Technology Subcommittee and senior management receive periodic briefings from the CIO and the CISO, concerning cybersecurity, information security and technology risks, and our related risk mitigation programs. In general, the Board is responsible for overseeing our enterprise risk management program ("ERM Program").
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] In general, the Board is responsible for overseeing our enterprise risk management program ("ERM Program").
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Board, Audit Committee and its Technology Subcommittee and senior management receive periodic briefings from the CIO and the CISO, concerning cybersecurity, information security and technology risks, and our related risk mitigation programs.
Cybersecurity Risk Role of Management [Text Block] Our cybersecurity program is managed by a dedicated Global Chief Information Officer ("CIO") whose team, including the head of Information Technology Security, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our CIO has over 35 years of relevant industry experience, including over 30 years at our Company. Our Vice President of Information Technology Security and Chief Information Security Officer ("CISO") has over 20 years of relevant industry experience. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming, as well as cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager. Our Board, Audit Committee and its Technology Subcommittee and senior management receive periodic briefings from the CIO and the CISO, concerning cybersecurity, information security and technology risks, and our related risk mitigation programs. In general, the Board is responsible for overseeing our enterprise risk management program ("ERM Program").
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our cybersecurity program is managed by a dedicated Global Chief Information Officer ("CIO") whose team, including the head of Information Technology Security, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our CIO has over 35 years of relevant industry experience, including over 30 years at our Company. Our Vice President of Information Technology Security and Chief Information Security Officer ("CISO") has over 20 years of relevant industry experience. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming, as well as cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CIO has over 35 years of relevant industry experience, including over 30 years at our Company. Our Vice President of Information Technology Security and Chief Information Security Officer ("CISO") has over 20 years of relevant industry experience. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming, as well as cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Audit Committee and its Technology Subcommittee provides another level of cybersecurity oversight through engagements at each Technology Subcommittee meeting with senior management, including our CIO and CISO. These reports include updates on our cybersecurity risks, threats, and incidents; our efforts to monitor, prevent, detect, mitigate and remediate the same; regulatory updates; the status of our cybersecurity projects, programs, and assessments; and periodic updates on our cybersecurity staffing and related matters.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true