XML 47 R28.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] We seek to identify, assess, and manage these risks, with the aim of safeguarding our critical systems and information and employing a documented process to respond in the event of a cybersecurity incident. This approach includes regular evaluations of our information
systems and infrastructure to identify vulnerabilities and potential weaknesses through the use of system monitoring tools, as well as monitoring of industry trends, threat intelligence, and emerging risks to anticipate and proactively assess potential threats. We engage third-party cybersecurity experts to conduct penetration testing, vulnerability scans, and risk assessments, informed by the NIST (National Institute of Standards and Technology) Cybersecurity Framework guidelines or ISO (International Organization for Standardization) 27001 standard, to increase the likelihood that system risks are identified.
To identify potential risks, Octave or a third party vendor engaged by the Company also assesses the security measures of vendors and third-party service providers that have access to the Company’s information systems and sensitive data. Each review involves an initial risk assessment of the provider and initial and periodic reviews of the provider's cybersecurity program to evaluate security standards, access controls and security measures. The Company generally requires vendors and third party service providers to report to the Company any cybersecurity incidents involving the providers’ systems that could affect the Company or to have cybersecurity incident notice requirements in their cybersecurity programs.
Our approach to managing cybersecurity risks includes implementing cybersecurity measures such as selective use of encryption, firewalls, data loss prevention, security monitoring, endpoint detection and response, anti-spam and anti-phishing email security, and intrusion detection systems to fortify our defenses. We conduct mandatory annual employee cybersecurity training programs and frequent simulated phishing campaigns to enhance cybersecurity knowledge and practices across the organization. Octave maintains an incident response plan that is updated regularly to respond to changes in the organization, risks and laws. Octave also conducts an annual test to restore business critical systems and data from back-ups. We have established reporting processes and escalation pathways for our business units and functions to identify, assess and manage potential cybersecurity incidents in a timely manner. Once an incident is identified, the Chief Information Security Officer (“CISO”) (with the assistance of the IT team) will begin the investigation to determine the level of risk of the event and the appropriate response.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Cybersecurity risk is also included in the Company’s Enterprise Risk Management (“ERM”) process that involves senior management and other personnel in the identification, assessment and management of a broad range of risks (including cybersecurity risks) that could affect the Company’s ability to execute on its corporate strategy and fulfill its business objectives.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
The Board of Directors of the Company oversees the management of risks from cybersecurity threats through its review of quarterly reports from the CISO on the status of the Company’s cybersecurity preparedness; updates on information systems; and any cybersecurity threats of which management has become aware. In addition the Board receives periodic cybersecurity awareness training.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Enterprise Risk Committee produces the relevant risk management information for executive and senior management and the Board of Directors, which receives ERM updates on a quarterly basis.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Company’s Chief Operating Officer and Chief Information Officer provide input and updates to the Enterprise Risk Committee (comprised of members of management) on cybersecurity preparedness and emerging risks.
Cybersecurity Risk Role of Management [Text Block]
The CISO conducts weekly meetings with the Chief Information Officer, and as necessary with the Enterprise Architecture Committee, to discuss the implementation of new cybersecurity measures. Identified cybersecurity risks and newly disclosed software patch updates are escalated, as appropriate, for further assessment and remediation in accordance with the Company’s vulnerability management procedures. The CISO also receives ongoing cybersecurity threat intelligence from external sources, including government and industry organizations such as the
Cybersecurity and Infrastructure Security Agency, which is used to inform the Company’s cybersecurity risk assessment and mitigation efforts.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Chief Operating Officer and Chief Information Officer are also members of the Company's Disclosure Committee and provide updates on cybersecurity threats and emerging risks to the Disclosure Committee prior to the filing of each quarterly report on Form 10-Q and annual report on Form 10-K.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Company’s Chief Information Officer and CISO bring over 35 years of combined experience in the technology and cybersecurity space. The Chief Information Officer has served as a chief information officer and chief technology officer of both private and public institutions for the past 10 years and was responsible for the IT operations and cybersecurity practices of those institutions. The CISO is a certified cybersecurity professional and technologist. He holds an active ISO/ANSI-accredited cybersecurity certification and has experience managing security programs across multiple industries, including financial services and insurance.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Chief Operating Officer and Chief Information Officer are also members of the Company's Disclosure Committee and provide updates on cybersecurity threats and emerging risks to the Disclosure Committee prior to the filing of each quarterly report on Form 10-Q and annual report on Form 10-K.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true