XML 26 R10.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management, Strategy and Governance
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Item 1C. Cybersecurity

Cybersecurity Risk Management

We assess, identify and manage material risks from cybersecurity threats through various policies, procedures and processes, including through our Enterprise Risk Management program (ERM), our information security policies and standards, workforce cybersecurity trainings and third-party assessments and programs.

The Company uses ERM principles to help identify, prevent, and mitigate potential risks, including cybersecurity and related risks. We base our ERM program on the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework. Individuals representing Stepan’s global locations and functions contribute to our risk assessments at least annually through surveys and in-person interviews. Members are polled quarterly to spot emerging risks and trends. The Company’s Vice President, Chief Compliance and Risk Officer leads the ERM program and reports regularly to the Audit Committee of the Board of Directors on ERM matters.

The Company maintains cybersecurity programs according to the set of guidelines developed by the National Institute of Standards and Technology through the Cybersecurity Framework. The Company maintains a set of IT Security Standards that provides a framework of layered security protection. In addition, the Company maintains and communicates to its workforce a Use of Information Technology Policy to support the understanding of and commitment to safely using IT assets. This knowledge can help prevent accidental or intentional misuse of Company IT resources, which can compromise the confidentiality, integrity, and availability of sensitive data and systems. The Company requires cybersecurity training to raise awareness and educate employees about cybersecurity risks. The Company updates its training program at least annually.

The Company engages a variety of IT assessors to evaluate and test the Company’s cybersecurity and cybersecurity controls. Additionally, the Company engages IT consultants to provide tabletop exercises, ransomware simulations, cyber policy and standards development, cybersecurity, data security, and IT training events, cybersecurity and data security testing and monitoring, and cybersecurity implementation projects.

Although the Company has put in place the cybersecurity policies, procedures and processes described above, the Company remains exposed to cybersecurity attacks and incidents and misuse or manipulation of any of its IT systems, which could have a material adverse effect on its business strategy, results of operations or financial condition. As of the filing of this Form 10-K, we are not aware of any attacks, incidents, misuse or manipulation that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. For risks associated with cybersecurity threats, see the risk factor “Interruption of, damage to or compromise of the Company’s information technology (IT) systems, failure to maintain the integrity of customer, colleague or Company data or illegal or fraudulent activities committed against the Company could harm the Company’s reputation and have an adverse effect on the Company’s business, financial position, results of operations and cash flows.” included in “Part I—Item 1A. Risk Factors” of this Annual Report on Form 10-K.

Cybersecurity Governance

The Audit Committee of the Company’s Board of Directors (the Audit Committee) oversees the Company’s cybersecurity risk management. The Audit Committee receives quarterly reports on cybersecurity risks and risk management from the Company’s Chief Information Officer. The Company’s Chief Information Officer, who reports to the President and Chief Executive Officer, is in charge of assessing and managing our risks related to cybersecurity and oversees a team of full-time cybersecurity specialist employees. Utilizing the processes noted above, this team remains informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The Company’s Chief Information Officer has served in a variety of IT and cybersecurity roles for more than twenty-five years, including serving in IT infrastructure, cybersecurity, enterprise application, and project management office leadership roles for both public and privately held companies in the chemical, pharmaceutical, and manufacturing industries. He has earned the IT Infrastructure Library (ITIL) Service Master Certification. The Company’s Cybersecurity Senior Manager, who reports to the Chief Information Officer, has earned multiple cybersecurity industry certifications and has over fifteen years of IT and cybersecurity experience. The Company’s cybersecurity program and cybersecurity practices are reviewed by internal and external auditors. The Company’s cybersecurity team provides periodic reports to such auditors.

Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

Cybersecurity Governance

The Audit Committee of the Company’s Board of Directors (the Audit Committee) oversees the Company’s cybersecurity risk management. The Audit Committee receives quarterly reports on cybersecurity risks and risk management from the Company’s Chief Information Officer. The Company’s Chief Information Officer, who reports to the President and Chief Executive Officer, is in charge of assessing and managing our risks related to cybersecurity and oversees a team of full-time cybersecurity specialist employees. Utilizing the processes noted above, this team remains informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The Company’s Chief Information Officer has served in a variety of IT and cybersecurity roles for more than twenty-five years, including serving in IT infrastructure, cybersecurity, enterprise application, and project management office leadership roles for both public and privately held companies in the chemical, pharmaceutical, and manufacturing industries. He has earned the IT Infrastructure Library (ITIL) Service Master Certification. The Company’s Cybersecurity Senior Manager, who reports to the Chief Information Officer, has earned multiple cybersecurity industry certifications and has over fifteen years of IT and cybersecurity experience. The Company’s cybersecurity program and cybersecurity practices are reviewed by internal and external auditors. The Company’s cybersecurity team provides periodic reports to such auditors.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee of the Company’s Board of Directors (the Audit Committee) oversees the Company’s cybersecurity risk management.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee receives quarterly reports on cybersecurity risks and risk management from the Company’s Chief Information Officer.
Cybersecurity Risk Role of Management [Text Block] The Company’s Chief Information Officer, who reports to the President and Chief Executive Officer, is in charge of assessing and managing our risks related to cybersecurity and oversees a team of full-time cybersecurity specialist employees. Utilizing the processes noted above, this team remains informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The Company’s Chief Information Officer has served in a variety of IT and cybersecurity roles for more than twenty-five years, including serving in IT infrastructure, cybersecurity, enterprise application, and project management office leadership roles for both public and privately held companies in the chemical, pharmaceutical, and manufacturing industries. He has earned the IT Infrastructure Library (ITIL) Service Master Certification. The Company’s Cybersecurity Senior Manager, who reports to the Chief Information Officer, has earned multiple cybersecurity industry certifications and has over fifteen years of IT and cybersecurity experience. The Company’s cybersecurity program and cybersecurity practices are reviewed by internal and external auditors. The Company’s cybersecurity team provides periodic reports to such auditors.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Company’s Chief Information Officer, who reports to the President and Chief Executive Officer, is in charge of assessing and managing our risks related to cybersecurity and oversees a team of full-time cybersecurity specialist employees.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Company’s Chief Information Officer has served in a variety of IT and cybersecurity roles for more than twenty-five years, including serving in IT infrastructure, cybersecurity, enterprise application, and project management office leadership roles for both public and privately held companies in the chemical, pharmaceutical, and manufacturing industries. He has earned the IT Infrastructure Library (ITIL) Service Master Certification. The Company’s Cybersecurity Senior Manager, who reports to the Chief Information Officer, has earned multiple cybersecurity industry certifications and has over fifteen years of IT and cybersecurity experience.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Utilizing the processes noted above, this team remains informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true