XML 99 R37.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] Cybersecurity
    Protecting the security of our information systems is of significant importance to us, and we are committed to our focus on cybersecurity and systemic risks. We have an enterprise risk assessment process which specifically addresses risks associated with cybersecurity. Additionally, we have a crisis management plan that outlines the structure, roles, responsibilities and operating procedures to utilize during potentially significant events that could negatively impact the Company. As part of the crisis management plan, we have a cybersecurity incident response plan in place that provides a documented framework for handling high severity security incidents and includes facilitated coordination across multiple functions of the Company. Our incident response plan also includes identifying and responding to material risks from cybersecurity threats associated with our use of third-party service providers. We invest in threat intelligence and are active participants in industry and government forums to strive to improve our overall capabilities with respect to cybersecurity. We routinely perform reviews of threat intelligence and vulnerability management capabilities, while performing simulations and drills at both technical and management levels. We incorporate external expertise in all aspects of our program utilizing best practice guidance from third-party cybersecurity advisors to provide objective assessments of our capabilities. We maintain a cyber liability insurance program, although the coverage may not be sufficient in some circumstances. We also have policies and practices in place to address data privacy regulations. Our cybersecurity program is reviewed and assessed by external information security specialists or by our internal audit group at least annually. Further, we conduct annual cybersecurity awareness training for employees and targeted training for high-risk functions of the Company. We also conduct phishing exercises and correlated education with our employees.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Protecting the security of our information systems is of significant importance to us, and we are committed to our focus on cybersecurity and systemic risks. We have an enterprise risk assessment process which specifically addresses risks associated with cybersecurity. Additionally, we have a crisis management plan that outlines the structure, roles, responsibilities and operating procedures to utilize during potentially significant events that could negatively impact the Company. As part of the crisis management plan, we have a cybersecurity incident response plan in place that provides a documented framework for handling high severity security incidents and includes facilitated coordination across multiple functions of the Company. Our incident response plan also includes identifying and responding to material risks from cybersecurity threats associated with our use of third-party service providers. We invest in threat intelligence and are active participants in industry and government forums to strive to improve our overall capabilities with respect to cybersecurity. We routinely perform reviews of threat intelligence and vulnerability management capabilities, while performing simulations and drills at both technical and management levels. We incorporate external expertise in all aspects of our program utilizing best practice guidance from third-party cybersecurity advisors to provide objective assessments of our capabilities. We maintain a cyber liability insurance program, although the coverage may not be sufficient in some circumstances. We also have policies and practices in place to address data privacy regulations. Our cybersecurity program is reviewed and assessed by external information security specialists or by our internal audit group at least annually. Further, we conduct annual cybersecurity awareness training for employees and targeted training for high-risk functions of the Company. We also conduct phishing exercises and correlated education with our employees.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] As part of its risk oversight role, our Audit Committee of the Board of Directors oversees cyber risk, information security and technology risk, including management’s actions to identify, assess, mitigate and remediate material cybersecurity issues and risks. The Audit Committee receives regular reporting several times each year from our Chief Information Security Officer as well as our Chief Digital Information Officer on our technology and cyber risk profile, enterprise cybersecurity program and key cybersecurity activities.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Audit Committee of the Board of Directors oversees cyber risk
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee receives regular reporting several times each year from our Chief Information Security Officer as well as our Chief Digital Information Officer on our technology and cyber risk profile, enterprise cybersecurity program and key cybersecurity activities.
Cybersecurity Risk Role of Management [Text Block] We have an information security team, led by our Chief Information Security Officer, that is responsible for assessing and managing cybersecurity risks and monitoring cybersecurity incidents. The team possess relevant experience in their respective fields as well, as appropriate certifications from various leading certifying bodies. During 2022, we established a Cybersecurity Council comprised of members of our senior leadership team that is regularly briefed on cybersecurity matters and provides input to our overall approach to cybersecurity. Our formal cybersecurity program is modeled after the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework, as well as other global standards and best practices.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] We have an information security team, led by our Chief Information Security Officer, that is responsible for assessing and managing cybersecurity risks and monitoring cybersecurity incidents. The team possess relevant experience in their respective fields as well, as appropriate certifications from various leading certifying bodies. During 2022, we established a Cybersecurity Council comprised of members of our senior leadership team that is regularly briefed on cybersecurity matters and provides input to our overall approach to cybersecurity. Our formal cybersecurity program is modeled after the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework, as well as other global standards and best practices.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The team possess relevant experience in their respective fields as well, as appropriate certifications from various leading certifying bodies.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Audit Committee receives regular reporting several times each year from our Chief Information Security Officer as well as our Chief Digital Information Officer on our technology and cyber risk profile, enterprise cybersecurity program and key cybersecurity activities.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true