XML 63 R32.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Strategy, Governance and Risk Management

Our Technology Risk Program is designed to proactively identify, monitor, and mitigate technology-related risks across our digital operations and assess cybersecurity risks related to third-party vendors and suppliers. Our Cybersecurity Program and our Technology Risk Program are led by our Chief Information Security Officer (“CISO”) a Certified Information Systems Security Professional with two decades of cybersecurity leadership. The CISO and his team are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The Technology Risk Oversight Committee chaired by our CISO, with members representing leadership throughout our Company, provides oversight and guidance to technology risks, including cybersecurity. Our Company’s Cybersecurity Program is designed to align with the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework and leading industry practices, and our Cybersecurity Program is integrated into our Company’s Enterprise Risk Management framework. Internal and external experts regularly evaluate our Cybersecurity Program, and the results of those reviews are reported to senior management and our Company’s Board of Directors. Our Incident Response Committee, which is comprised of leaders in the areas of information security, digital, legal, finance, privacy, compliance and ethics, corporate security and communications, is responsible for leading our Company’s response to cyber incidents. Our Cybersecurity Incident Response Plan outlines the processes by which management is informed about and monitors detection and mediation of cyber incidents. We actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We have a Data Protection Office that works closely with, and assists, our enterprise Privacy Program, overseen by the Chief Privacy Officer, along with advisory support from appointed Data Protection Officers in Europe and Quebec.

While we have experienced cybersecurity threats and breaches targeting our information technology systems and networks and those of our third-party providers, including within the last three years, these incidents have not had a material impact on our Company, including our business strategy, results of operations or financial condition. Risks from cybersecurity threats, including previous cybersecurity incidents encountered by the Company and known incidents encountered by third parties with a connection to the Company, are also not currently viewed as reasonably likely to materially impact our Company, including our business strategy, results of operations or financial condition. We are regularly the target of attempted cyber intrusions, have experienced cyber intrusions, and we anticipate continuing to be subject to such attempts as cyber intrusions become increasingly sophisticated and more difficult to predict and protect against. Geopolitical conflicts and developments and technological advancements also increase the risk and likelihood of cyber incidents. As such, we must commit substantial resources to continuously monitor and further develop our networks and infrastructure to prevent, detect, and address the risk of unauthorized access, misuse, computer viruses and other events. Although we have implemented and maintain commercially reasonable security measures and safeguards, including to protect against and identify potential threats, these protections and other systems designed to mitigate cybersecurity risks may not fully defend against an attack or future cybersecurity incident, which can be unpredictable in nature. Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. See Item 1A. Risk Factors — Significant cybersecurity incidents negatively impact our business and our relationships with customers, vendors and employees and expose us to increased liability for additional discussion.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Our Company’s Cybersecurity Program is designed to align with the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework and leading industry practices, and our Cybersecurity Program is integrated into our Company’s Enterprise Risk Management framework
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

Board Oversight

Management has primary responsibility for risk management within our Company. The Company’s Board of Directors, with the support of its committees, oversees risk management to ensure that the processes designed, implemented and maintained by our executives are functioning as intended and adapted when necessary to respond to changes in our Company’s strategy as well as emerging risks. The Audit Committee of the Company’s Board of Directors has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses. The Audit Committee receives reports on these matters from our most senior executives in the digital organization, including

our Chief Information Officer and CISO, and the Company’s executive officers, at least twice a year. Topics historically covered in such reports, and for which our Board exercises oversight, include third-party evaluation of our technology infrastructure and information security against the NIST cybersecurity framework; management of emerging cyber threats such as merger and acquisition activity and the adoption and governance of artificial intelligence; risk mitigation through the Company’s enterprise-wide cybersecurity training, including our Board of Directors, conducted at least annually; regular simulated phishing tests and third-party penetration testing; review of the Company’s cyber incident insurance coverage and external cyber incident resources; review of the Company’s Cybersecurity Incident Response Plan; review of readouts from cyber incident table top exercises; and consideration of applicable laws and regulations, including those related to privacy. The Company’s Cybersecurity Incident Response Plan includes a section on Board escalation that specifies the process for notification of the Chair of the Audit Committee and the Chair of the Board of the Directors upon certain triggering events, and that group then determines the appropriate form and frequency of communication with the full Audit Committee or Board of Directors, depending on the unique characteristics of the incident.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee receives reports on these matters from our most senior executives in the digital organization, including our Chief Information Officer and CISO, and the Company’s executive officers, at least twice a year. Topics historically covered in such reports, and for which our Board exercises oversight, include third-party evaluation of our technology infrastructure and information security against the NIST cybersecurity framework; management of emerging cyber threats such as merger and acquisition activity and the adoption and governance of artificial intelligence; risk mitigation through the Company’s enterprise-wide cybersecurity training, including our Board of Directors, conducted at least annually; regular simulated phishing tests and third-party penetration testing; review of the Company’s cyber incident insurance coverage and external cyber incident resources; review of the Company’s Cybersecurity Incident Response Plan; review of readouts from cyber incident table top exercises; and consideration of applicable laws and regulations, including those related to privacy.
Cybersecurity Risk Role of Management [Text Block] Management has primary responsibility for risk management within our Company. The Company’s Board of Directors, with the support of its committees, oversees risk management to ensure that the processes designed, implemented and maintained by our executives are functioning as intended and adapted when necessary to respond to changes in our Company’s strategy as well as emerging risks.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Chief Information Security Officer (“CISO”)
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Certified Information Systems Security Professional with two decades of cybersecurity leadership
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Company’s Cybersecurity Incident Response Plan includes a section on Board escalation that specifies the process for notification of the Chair of the Audit Committee and the Chair of the Board of the Directors upon certain triggering events, and that group then determines the appropriate form and frequency of communication with the full Audit Committee or Board of Directors, depending on the unique characteristics of the incident
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true