XML 38 R25.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit and Risk Committee, and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity activities into five categories: identify, protect, detect, respond and recover. Our cybersecurity risk management program is part of our overall risk assessment. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation, and investments in a partnership with a third-party vendor whose experts further advise our processes. Our executive team, which includes VPs of IT, review enterprise risk management-level cybersecurity risks annually, along with other key risks to the organization. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security policy as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, malware protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Our cybersecurity risk management program is part of our overall risk assessment. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation, and investments in a partnership with a third-party vendor whose experts further advise our processes. Our executive team, which includes VPs of IT, review enterprise risk management-level cybersecurity risks annually, along with other key risks to the organization. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security policy as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, malware protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] The Audit and Risk Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The VPs of IT are responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The VPs of IT are responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board.
Cybersecurity Risk Role of Management [Text Block] Our executive team, which includes VPs of IT, review enterprise risk management-level cybersecurity risks annually, along with other key risks to the organization. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security policy as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, malware protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
The Audit and Risk Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit and Risk Committee performs an annual review of the Company’s cybersecurity program and the Company’s overall risk assessment, which includes discussion of management’s actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. The Audit and Risk Committee’s annual review also includes review of recent enhancements to the Company’s defenses and management’s progress on its cybersecurity strategic roadmap. In addition, the Board receives regular cybersecurity updates, which include a review of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. Further, at least annually, the Board receives updates on the Company’s Business Continuity Plan, which covers, among other things, potential cybersecurity incidents, and potential impacts to data privacy and compliance. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics. For example, the Board has hosted an outside expert to discuss developments in the cybersecurity threat landscape.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our VPs of IT have extensive experience leading cybersecurity oversight.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit and Risk Committee, and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true