XML 44 R27.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Our cybersecurity-specific risk assessment process benchmarks our practices against standards set by the National Institute of Standards and Technology (“NIST”), International Organization for Standardization (“ISO”), and the Center for Internet Security (“CIS”), and includes penetration tests to evaluate the security of our information systems, as such term is defined in Item 106(a) of Regulation S-K.
To safeguard critical data and systems, support regulatory compliance, manage our material risks from cybersecurity threats, and identify, assess and respond to potential cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we:
Monitor emerging data protection laws and adjust our processes and procedures as required or appropriate;
Utilize Endpoint Detection and Response (EDR) tools to help us prevent, detect, and respond to endpoint threats with real-time visibility across our infrastructure and devices, enterprise-wide;
Provide periodic, but no less than annual, training on cybersecurity, data privacy, and data handling to all employees and contractors with access to our systems;
Conduct periodic, but no less than, annual cybersecurity management and incident response training for relevant personnel, utilizing Knowbe4 resources;
Implement regular phishing simulations and processes for reporting phishing events and concerns to enhance staff awareness, vigilance, and responsiveness;
Mandate that both employees and service providers treat sensitive data with utmost care, enforced through policies, practices, and contracts;
Employ elements of the NIST incident handling framework for identifying, protecting, detecting, responding to, and recovering from cybersecurity incidents; and
Maintain cybersecurity risk insurance to mitigate potential financial losses from incidents.
Our incident response plan outlines our approach to preparing for, detecting, responding to, and recovering from cybersecurity incidents, including severity assessment, containment, investigation, and remediation processes.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have established cybersecurity measures, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Cybersecurity is integrated with our overall risk management strategy and is an area of focus for our Board and management
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee, and where applicable, other directors or the entire Board, are involved in overseeing cybersecurity risks.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] They receive quarterly and bi-annual updates, respectively, on our cybersecurity threat risk management and strategy processes, and may meet more frequently in response to specific threats or incidents. These updates, provided by our Chief Financial Officer and/or our global head of Information Technology, cover various cybersecurity topics, including data security posture, third-party assessment results, progress on risk mitigation goals, incident response plans, and select cybersecurity threat risks or incidents. The Board and Audit Committee also have discussions with our global head of Information Technology and engage in separate meetings to consider cybersecurity risks in the context of broader corporate matters.
Cybersecurity Risk Role of Management [Text Block]
Our cybersecurity risk management and strategy processes are led by our global head of Information Technology who reports directly to our Chief Financial Officer and focus on preventing, mitigating, detecting and remediating cybersecurity incidents, as well as threat risks and related matters. The global head of Information Technology is part of our operating team and is responsible for implementing our cybersecurity risk management and strategy processes and the operation of our incident response and business continuity plan. Management uses information provided by our global head of Information Technology, along with feedback from external experts, the Audit Committee, and our Board, as part of the cyber-specific and enterprise-wide risk management process described above.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our cybersecurity risk management and strategy processes are led by our global head of Information Technology who reports directly to our Chief Financial Officer and focus on preventing, mitigating, detecting and remediating cybersecurity incidents, as well as threat risks and related matters. The global head of Information Technology is part of our operating team and is responsible for implementing our cybersecurity risk management and strategy processes and the operation of our incident response and business continuity plan.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]
Our information technology and cybersecurity team has approximately 35 years of collective experience in information security and cybersecurity strategy, with various roles in significant organizations. Team members’ relevant degrees and certifications include but are not limited to Certified Information Security Manager, Certified Information Systems Security Professional, Certified Ethical Hacker, Certified Penetration Tester, among others.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Management uses information provided by our global head of Information Technology, along with feedback from external experts, the Audit Committee, and our Board, as part of the cyber-specific and enterprise-wide risk management process described above.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true