XML 58 R39.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical information technology (“IT”) systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan and is one aspect of the overall set of policies, procedures and techniques that we employ at the Company to manage risk. Many of the mechanisms for identifying, managing and reporting on cybersecurity risk are integrated into the Company’s broader policies and procedures relating to risk management; however, due to the unique nature of cybersecurity risk, key aspects of our cybersecurity risk management program are intended to function on a stand-alone basis, including to ensure rapid escalation and response to cybersecurity incidents.
Our cybersecurity risk management program includes:
Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, operations, and our Company’s overall IT environment;
A team of IT professionals principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) together with our legal/compliance team, our response to cybersecurity incidents;
Use of third-party service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including, without limitation, periodic penetration testing, network vulnerability and web application scanning, and system monitoring via System Information and Event Management (“SIEM”) or other monitoring tools;
Employee and contractor trainings on information security awareness, data privacy awareness, and phishing/social engineering mitigation, as well as periodic tabletop exercises involving IT professionals and executive management to review roles and responsibilities and walk through practical aspects of responding to cybersecurity incidents;
A cybersecurity incident response plan that sets forth guidelines, policies and procedures for identification, escalation, containment, investigation, remediation, recovery, notification, legal compliance and related processes and actions in response to a cybersecurity incident; and
A risk management process for third-party service providers, suppliers, and vendors, which includes criteria for risk-based categorization of these third parties and policies and procedures relating to assessing their cybersecurity practices prior to engagement and periodic monitoring during the course of engagement.
We design and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”) – i.e., we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business, but our use of the NIST CSF as a guide does not mean that we meet the particular technical standards, specifications, or requirements of all of the NIST CSF.
We have not currently identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information about cybersecurity risk, refer to Part II, Item 7 of this Annual Report on Form 10-K generally and under the heading “Maintaining cybersecurity and complying with data privacy laws and regulations are important to our business and a breach of our cybersecurity or a violation of data privacy laws could result in serious harm to our reputation and have a material adverse impact on our business and financial results” in Part I, Item 1A of this Annual Report on Form 10-K.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical information technology (“IT”) systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan and is one aspect of the overall set of policies, procedures and techniques that we employ at the Company to manage risk. Many of the mechanisms for identifying, managing and reporting on cybersecurity risk are integrated into the Company’s broader policies and procedures relating to risk management; however, due to the unique nature of cybersecurity risk, key aspects of our cybersecurity risk management program are intended to function on a stand-alone basis, including to ensure rapid escalation and response to cybersecurity incidents.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
As part of its risk oversight function, our Board, including through delegation to its Audit Committee, regularly receives risk management reporting from various officers of the Company responsible for different risk disciplines, including with respect to cybersecurity and IT risk, and oversees management’s administration of our cybersecurity risk management program. For example, officers within our IT department provide periodic (generally at least once per quarter) reports from management to the Audit Committee related to cybersecurity, our cybersecurity risk management program and related risks, with copies of these reports also provided to our full Board. These reports supplement materials and presentations from outside experts that are also provided to our Board members from time to time as part of the Board’s and Audit Committee’s continuing education on risk oversight topics such as cybersecurity that impact companies in our industry and, more generally, publicly-traded companies. In addition, management
provides event-driven updates to the Audit Committee and Board regarding any material cybersecurity incidents and, as appropriate, any incidents with lesser impact potential. Under our cybersecurity incident response plan, our Chief Legal Officer is responsible for escalating to the Audit Committee and Board information regarding any material cybersecurity incident.
Our management team, including officers within our IT department, is responsible for assessing and managing our material risks from cybersecurity threats. Our IT department has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and the external cybersecurity consultants we retain. The officers and employees of the Company who manage our IT function and our cybersecurity risk management program have significant experience, individually and collectively, and key members of our IT department hold industry certifications, including multiple individuals who are Certified Information System Security Professionals (“CISSP”) and Certified Information Systems Auditors (“CISA”). Overall, we believe we have a team of IT professionals skilled in a range of disciplines related to the design and implementation of our cybersecurity program, as well as in assessing security controls and processes and addressing or remediating emerging threats and findings that are identified.
Members of our senior management team supervise our IT function and its efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents. In addition to day-to-day management, our senior management team’s supervision of these efforts includes receiving and responding to briefings from IT personnel, updates on cyberthreat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and notification of significant alerts and reports produced by third parties and security tools deployed in our IT environment.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] As part of its risk oversight function, our Board, including through delegation to its Audit Committee, regularly receives risk management reporting from various officers of the Company responsible for different risk disciplines, including with respect to cybersecurity and IT risk, and oversees management’s administration of our cybersecurity risk management program.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
As part of its risk oversight function, our Board, including through delegation to its Audit Committee, regularly receives risk management reporting from various officers of the Company responsible for different risk disciplines, including with respect to cybersecurity and IT risk, and oversees management’s administration of our cybersecurity risk management program. For example, officers within our IT department provide periodic (generally at least once per quarter) reports from management to the Audit Committee related to cybersecurity, our cybersecurity risk management program and related risks, with copies of these reports also provided to our full Board. These reports supplement materials and presentations from outside experts that are also provided to our Board members from time to time as part of the Board’s and Audit Committee’s continuing education on risk oversight topics such as cybersecurity that impact companies in our industry and, more generally, publicly-traded companies. In addition, management
provides event-driven updates to the Audit Committee and Board regarding any material cybersecurity incidents and, as appropriate, any incidents with lesser impact potential. Under our cybersecurity incident response plan, our Chief Legal Officer is responsible for escalating to the Audit Committee and Board information regarding any material cybersecurity incident.
Cybersecurity Risk Role of Management [Text Block]
Our management team, including officers within our IT department, is responsible for assessing and managing our material risks from cybersecurity threats. Our IT department has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and the external cybersecurity consultants we retain. The officers and employees of the Company who manage our IT function and our cybersecurity risk management program have significant experience, individually and collectively, and key members of our IT department hold industry certifications, including multiple individuals who are Certified Information System Security Professionals (“CISSP”) and Certified Information Systems Auditors (“CISA”). Overall, we believe we have a team of IT professionals skilled in a range of disciplines related to the design and implementation of our cybersecurity program, as well as in assessing security controls and processes and addressing or remediating emerging threats and findings that are identified.
Members of our senior management team supervise our IT function and its efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents. In addition to day-to-day management, our senior management team’s supervision of these efforts includes receiving and responding to briefings from IT personnel, updates on cyberthreat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and notification of significant alerts and reports produced by third parties and security tools deployed in our IT environment.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
Our management team, including officers within our IT department, is responsible for assessing and managing our material risks from cybersecurity threats. Our IT department has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and the external cybersecurity consultants we retain. The officers and employees of the Company who manage our IT function and our cybersecurity risk management program have significant experience, individually and collectively, and key members of our IT department hold industry certifications, including multiple individuals who are Certified Information System Security Professionals (“CISSP”) and Certified Information Systems Auditors (“CISA”). Overall, we believe we have a team of IT professionals skilled in a range of disciplines related to the design and implementation of our cybersecurity program, as well as in assessing security controls and processes and addressing or remediating emerging threats and findings that are identified.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The officers and employees of the Company who manage our IT function and our cybersecurity risk management program have significant experience, individually and collectively, and key members of our IT department hold industry certifications, including multiple individuals who are Certified Information System Security Professionals (“CISSP”) and Certified Information Systems Auditors (“CISA”).
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] In addition, management provides event-driven updates to the Audit Committee and Board regarding any material cybersecurity incidents and, as appropriate, any incidents with lesser impact potential. Under our cybersecurity incident response plan, our Chief Legal Officer is responsible for escalating to the Audit Committee and Board information regarding any material cybersecurity incident.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true