XML 49 R32.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Our information security program is managed by a dedicated Chief Information Security Officer ("CISO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, risk assessment and management policies, standards, architecture, and processes. The CISO, along with the Chief Information and Digital Officer ("CIDO"), each have over 20 years of prior work experience in various roles involving information technology, including security, compliance, and systems. The CISO provides periodic reports, which take into account information from internal stakeholders, known privacy and security vulnerabilities, threat detection plans, and information from external sources such as reported security incidents, industry trends, and third-party evaluations to our executive leadership team and, as well as regular updates to our Audit Committee. The Audit Committee receives regular updates specific to the company’s cyber security program and IT security risk, including threat protection posture, IT compliance reporting, and IT risk posture. The Board of Directors ("Board") has ultimate oversight for risks relating to our information security program and practices and receives periodic updates from the Audit Committee Chair on cybersecurity and IT security risk and mitigation strategies, as well as periodic updates directly from the CIDO and CISO. Our program is regularly evaluated by internal and external resources with the results of those reviews reported to senior management, the Audit Committee and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities for benchmarking and awareness of best practices as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. As part of our cybersecurity risk management system, our governance, risk and compliance team tracks and logs privacy and security incidents across GPC as well as performs third-party risk management to identify and mitigate risks from third parties such as vendors and suppliers. The results of our evaluations and the feedback from our engagements are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.
Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program to ensure that cybersecurity considerations are an integral part of our decision-making processes and are based on frameworks established by the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”) and other applicable industry standards. In connection with our information security program, we perform ongoing internal and external risk assessment activities, and deploy systems, processes, and procedures across our global business units in response to identified risks. As cybersecurity events are detected via our global processes, the potential impact of the events is assessed based on criticality, and mitigation and remediation actions are taken in accordance with our incident response plan. The incident response plan is periodically evaluated by our cybersecurity team as well as by independent advisors using simulated security exercises. Security awareness training is also key component of our information security program and involves required training for all our teammates and contingent workers.
Although we have not experienced a material breach of cybersecurity to date, our computer systems and the computer systems of our third-party service providers have been, and will likely continue to be, subjected to unauthorized access or phishing attempts, computer viruses, malware, ransomware or other malicious codes. Despite our security measures, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information about these and other information security risks we face, see “Item 1A. Risk Factors — Strategic and Operational Risks.”
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program to ensure that cybersecurity considerations are an integral part of our decision-making processes and are based on frameworks established by the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”) and other applicable industry standards.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] The Board of Directors ("Board") has ultimate oversight for risks relating to our information security program and practices and receives periodic updates from the Audit Committee Chair on cybersecurity and IT security risk and mitigation strategies, as well as periodic updates directly from the CIDO and CISO. Our program is regularly evaluated by internal and external resources with the results of those reviews reported to senior management, the Audit Committee and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities for benchmarking and awareness of best practices as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. As part of our cybersecurity risk management system, our governance, risk and compliance team tracks and logs privacy and security incidents across GPC as well as performs third-party risk management to identify and mitigate risks from third parties such as vendors and suppliers. The results of our evaluations and the feedback from our engagements are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.
Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program to ensure that cybersecurity considerations are an integral part of our decision-making processes and are based on frameworks established by the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”) and other applicable industry standards. In connection with our information security program, we perform ongoing internal and external risk assessment activities, and deploy systems, processes, and procedures across our global business units in response to identified risks. As cybersecurity events are detected via our global processes, the potential impact of the events is assessed based on criticality, and mitigation and remediation actions are taken in accordance with our incident response plan. The incident response plan is periodically evaluated by our cybersecurity team as well as by independent advisors using simulated security exercises. Security awareness training is also key component of our information security program and involves required training for all our teammates and contingent workers.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Board of Directors ("Board") has ultimate oversight for risks relating to our information security program and practices and receives periodic updates from the Audit Committee Chair on cybersecurity and IT security risk and mitigation strategies, as well as periodic updates directly from the CIDO and CISO.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The CISO provides periodic reports, which take into account information from internal stakeholders, known privacy and security vulnerabilities, threat detection plans, and information from external sources such as reported security incidents, industry trends, and third-party evaluations to our executive leadership team and, as well as regular updates to our Audit Committee. The Audit Committee receives regular updates specific to the company’s cyber security program and IT security risk, including threat protection posture, IT compliance reporting, and IT risk posture. The Board of Directors ("Board") has ultimate oversight for risks relating to our information security program and practices and receives periodic updates from the Audit Committee Chair on cybersecurity and IT security risk and mitigation strategies, as well as periodic updates directly from the CIDO and CISO.
Cybersecurity Risk Role of Management [Text Block] The CISO provides periodic reports, which take into account information from internal stakeholders, known privacy and security vulnerabilities, threat detection plans, and information from external sources such as reported security incidents, industry trends, and third-party evaluations to our executive leadership team and, as well as regular updates to our Audit Committee.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The CISO, along with the Chief Information and Digital Officer ("CIDO"), each have over 20 years of prior work experience in various roles involving information technology, including security, compliance, and systems. The CISO provides periodic reports, which take into account information from internal stakeholders, known privacy and security vulnerabilities, threat detection plans, and information from external sources such as reported security incidents, industry trends, and third-party evaluations to our executive leadership team and, as well as regular updates to our Audit Committee.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The CISO, along with the Chief Information and Digital Officer ("CIDO"), each have over 20 years of prior work experience in various roles involving information technology, including security, compliance, and systems.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The CISO provides periodic reports, which take into account information from internal stakeholders, known privacy and security vulnerabilities, threat detection plans, and information from external sources such as reported security incidents, industry trends, and third-party evaluations to our executive leadership team and, as well as regular updates to our Audit Committee. The Audit Committee receives regular updates specific to the company’s cyber security program and IT security risk, including threat protection posture, IT compliance reporting, and IT risk posture. The Board of Directors ("Board") has ultimate oversight for risks relating to our information security program and practices and receives periodic updates from the Audit Committee Chair on cybersecurity and IT security risk and mitigation strategies, as well as periodic updates directly from the CIDO and CISO. Our program is regularly evaluated by internal and external resources with the results of those reviews reported to senior management, the Audit Committee and the Board.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true