XML 58 R31.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our strategic priorities is integrated into our enterprise risk management program and enterprise risk assessment process. This provides cross-functional and geographical visibility, as well as executive leadership oversight, to address and mitigate associated risks. We engage our internal information technology (IT) audit group to audit our information security programs, and the results are reported to our executive management and the Audit Committee of our Board of Directors. We also engage third party firms to identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards, such as the National Institute of Standards and Technology (NIST) Cyber Security Framework, NIST 800-53, NIST 800-82, and International Electrotechnical Commission 62443.

In managing material risks from cybersecurity threats, we require that a security and technical architecture review is conducted for all new software and applications, and for all changes to the underlying information technology infrastructure that manages, processes, stores, or transmits our data or data of our customers, vendors, suppliers, joint ventures, or employees. Any deviations from our information security policies and standards are assessed by our Information Security Governance team. Any critical and high-risk levels that are identified are then documented and reported to relevant key stakeholders.

Our policies and procedures also address the oversight, identification, and mitigation of cybersecurity risks associated with our use of third-party service providers. Our policy requires that all software vendors and IT related service providers submit to an IT security and governance review and obtain formal approval by our Information Security Governance team before it can be used.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our strategic priorities is integrated into our enterprise risk management program and enterprise risk assessment process.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] We have experienced cybersecurity incidents and attempted breaches in the past, one of which resulted in an unauthorized third party gaining access to certain of our systems and exfiltrating information from those systems, which we determined was a material event as previously disclosed in a Form 8-K we filed with the SEC on September 3, 2024
Cybersecurity Risk Board of Directors Oversight [Text Block]
Aside from more immediate reporting of material incidents to our Board of Directors as described above, our CISO provides our Board of Directors an update on cybersecurity during each of its quarterly meetings. This update includes data on certain cybersecurity metrics, information on internal and third-party cybersecurity incidents, and general discussion of cybersecurity risks. In addition, our Audit Committee receives a detailed update annually from the CIO and CISO, which includes in-depth updates on our cybersecurity program and strategy including cybersecurity risks.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] CISO provides our Board of Directors an update on cybersecurity during each of its quarterly meetings.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] This update includes data on certain cybersecurity metrics, information on internal and third-party cybersecurity incidents, and general discussion of cybersecurity risks. In addition, our Audit Committee receives a detailed update annually from the CIO and CISO, which includes in-depth updates on our cybersecurity program and strategy including cybersecurity risks.
Cybersecurity Risk Role of Management [Text Block] The CIO leads all components of our IT functions. Our CIO has over 20 years of experience with Halliburton and has had numerous global assignments across all areas of IT delivery, operations, and management. Our CISO, who reports directly to our Executive Vice President of Administration and Chief Human Resources Officer, has over 20 years of technology and cybersecurity experience across global enterprises, risk advisory, and incident response firms.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] We have an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. In the event there is a cybersecurity incident, an Incident Response Team will assess the cybersecurity incident’s impact as the basis for assigning a preliminary severity rating. This team then provides the Chief Information Security Officer (CISO) with a summary and preliminary severity rating and the CISO subsequently notifies the Chief Information Officer (CIO) as appropriate. The CISO and CIO will assess situational information and business impact to finalize the severity rating. The CISO is then responsible for communicating incidents to other members of management as appropriate.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CIO has over 20 years of experience with Halliburton and has had numerous global assignments across all areas of IT delivery, operations, and management. Our CISO, who reports directly to our Executive Vice President of Administration and Chief Human Resources Officer, has over 20 years of technology and cybersecurity experience across global enterprises, risk advisory, and incident response firms.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] We have an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. In the event there is a cybersecurity incident, an Incident Response Team will assess the cybersecurity incident’s impact as the basis for assigning a preliminary severity rating. This team then provides the Chief Information Security Officer (CISO) with a summary and preliminary severity rating and the CISO subsequently notifies the Chief Information Officer (CIO) as appropriate. The CISO and CIO will assess situational information and business impact to finalize the severity rating. The CISO is then responsible for communicating incidents to other members of management as appropriate
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true