XML 54 R29.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to
cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our
strategic priorities is integrated into our enterprise risk management program and enterprise risk assessment process. This
provides cross-functional and geographical visibility, as well as executive leadership oversight, to address and mitigate
associated risks. We engage our internal information technology (IT) audit group to audit our information security programs,
and the results are reported to our executive management and the Audit Committee of our Board of Directors. We also engage
third party firms to identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards, including the
National Institute of Standards and Technology (NIST) Cyber Security Framework, NIST 800-53, NIST 800-82, and
International Electrotechnical Commission 62443.
In managing material risks from cybersecurity threats, we require a security and technical architecture review for all
new software and applications, and for all changes to the underlying IT infrastructure that manages, processes, stores, or
transmits our data or data of our customers, vendors, suppliers, joint ventures, or employees. Any deviations from our policies
and standards are assessed by our IT & Information Security Governance processes. Any critical and high-risk levels that are
identified are then documented and reported to relevant key stakeholders.
Our policies and procedures also address the oversight, identification, and mitigation of cybersecurity risks associated
with our use of third-party service providers. Our policy requires that each third-party service provider go through a mandatory
IT & Information Security Governance processes review and obtain formal approval from our IT & Information Security
Governance groups before it can be used.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to
cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our
strategic priorities is integrated into our enterprise risk management program and enterprise risk assessment process.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] We have experienced cybersecurity incidents and attempted breaches in the past, one of which resulted in an
unauthorized third party gaining access to certain of our systems and exfiltrating information from those systems, which we
determined was a material cybersecurity incident as previously disclosed in a Form 8-K we filed with the SEC on September 3,
2024.
Cybersecurity Risk Board of Directors Oversight [Text Block] Aside from more immediate reporting of material incidents to our Board of Directors as described above, our CISO
provides our Board of Directors with an update on cybersecurity during each of its quarterly meetings. This update includes
data on certain cybersecurity metrics, information on internal and third-party cybersecurity incidents, and general discussion of
cybersecurity risks. In addition, our Audit Committee receives a detailed update annually from the CISO, which includes in-
depth updates on our cybersecurity program and strategy including cybersecurity risks.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] CISO provides our Board of Directors with an update on cybersecurity during each of its quarterly meetings.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] This update includes
data on certain cybersecurity metrics, information on internal and third-party cybersecurity incidents, and general discussion of
cybersecurity risks. In addition, our Audit Committee receives a detailed update annually from the CISO, which includes in-
depth updates on our cybersecurity program and strategy including cybersecurity risks.
Cybersecurity Risk Role of Management [Text Block] The CIO leads all components of our IT functions. Our CIO has over 20 years of experience with Halliburton and has
had numerous global assignments across all areas of IT delivery, operations, and management. Our CISO, who reports directly
to our Executive Vice President and Chief Administrative Officer, has over 25 years of experience in the areas of operations,
infrastructure and applications, solution and demand design.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CIO has over 20 years of experience with Halliburton and has
had numerous global assignments across all areas of IT delivery, operations, and management. Our CISO, who reports directly
to our Executive Vice President and Chief Administrative Officer, has over 25 years of experience in the areas of operations,
infrastructure and applications, solution and demand design.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] We have an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a
cybersecurity incident. In the event there is a cyber security incident, an Incident Response Team will assess the cybersecurity
incident’s impact as the basis for assigning a preliminary severity rating. This team then provides the Chief Information
Security Officer (CISO) with a summary and preliminary severity rating and the CISO subsequently notifies the Chief
Information Officer (CIO) as appropriate.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true