XML 55 R36.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Risk Management and Strategy
The security of the Company’s products, data, services and network is a critical priority. To effectively assess, identify and manage material risks associated with cybersecurity threats, the Company has adopted a comprehensive approach with respect to acceptable use, risk management, data privacy, education and awareness, security incident management and reporting, identity and access management, third-party management, security (with respect to physical assets, products, networks and systems), security monitoring and vulnerability identification. The Company has, and continues to, invest in internal and external tools to better detect, patch, monitor, and restore systems. Further, the Company maintains cybersecurity insurance coverage intended to protect against loss of business and other related consequences resulting from cyber incidents.
The Company also maintains a global incident response plan and regularly conducts exercises to help with our overall preparedness. The Company takes measures to improve and update our cybersecurity program, including independent third party assessments, penetration testing and scanning of our systems for vulnerabilities. The Company pairs with assessors, consultants, auditors, and other third-party service providers and advisers to assist in monitoring cybersecurity risks.
The Company remains committed to preserving the integrity of its network, while remaining adaptable to identify new and emerging threats relying on both internal and external research and intelligence gathering. The Company has instituted a Cybersecurity Awareness Month program and the Cybersecurity Champion Network for continuous improvement via trainings and continued awareness on emerging cybersecurity risks.
During 2022, the Company detected a cyber-security incident which impacted the Company’s network. The Company promptly activated incident response protocols and completed a thorough investigation. The incidents did not have a material impact on our business, operations or financial results.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] To effectively assess, identify and manage material risks associated with cybersecurity threats, the Company has adopted a comprehensive approach with respect to acceptable use, risk management, data privacy, education and awareness, security incident management and reporting, identity and access management, third-party management, security (with respect to physical assets, products, networks and systems), security monitoring and vulnerability identification.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
The Company and its Board understands the importance of maintaining a secure environment for our products, data and systems that effectively supports our business objectives and customer needs. Cybersecurity risks are overseen by the Audit Committee of the Board. The Senior Vice-President and Chief Information Officer (“CIO”) and Chief Information Security Officer (“CISO”) provide ongoing and continuing reports to the Audit Committee, which includes information about cyber-risk management, the effectiveness of the Company’s cybersecurity framework, and benchmarking the Company against its industry peers. The CISO is responsible for navigating cyber risks, data access governance, security governance and global regulatory compliance related to cybersecurity regulations and industry standards. The Company also has a Chief Product Security Officer (“CPSO”) who manages imbedding cybersecurity in the Company’s products and services as they are being developed.
The Company’s CIO, CISO, and cybersecurity team collectively have decades of experience in various roles managing information security, developing cybersecurity strategy, and implementing, planning and operationalizing a comprehensive global IT infrastructure. Our CIO and CISO maintain relevant degrees, certifications, and trainings while also being recognized as experts in their respective fields by industry leaders.
The Company also conducts ongoing cyber security reviews which includes updates on the Company’s enterprise cybersecurity risk and product cybersecurity risk. Risk is assessed utilizing internal key performance indicators and external evaluations to determine the Company’s cybersecurity score in comparison to its peer group. Wabtec's Board of Directors participates in all enterprise annual security awareness training and phishing campaigns. Throughout the year, as appropriate, in addition to regularly scheduled updates, the Audit Committee, CIO, and CISO maintain an ongoing dialogue regarding the Company’s cybersecurity risk and posture. The cybersecurity framework is also supported by Wabtec's broader enterprise risk management process to ensure alignment of the Company’s cybersecurity efforts with the Company’s overall enterprise risk management.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Senior Vice-President and Chief Information Officer (“CIO”) and Chief Information Security Officer (“CISO”)
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Cybersecurity risks are overseen by the Audit Committee of the Board.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
The Company and its Board understands the importance of maintaining a secure environment for our products, data and systems that effectively supports our business objectives and customer needs. Cybersecurity risks are overseen by the Audit Committee of the Board. The Senior Vice-President and Chief Information Officer (“CIO”) and Chief Information Security Officer (“CISO”) provide ongoing and continuing reports to the Audit Committee, which includes information about cyber-risk management, the effectiveness of the Company’s cybersecurity framework, and benchmarking the Company against its industry peers. The CISO is responsible for navigating cyber risks, data access governance, security governance and global regulatory compliance related to cybersecurity regulations and industry standards. The Company also has a Chief Product Security Officer (“CPSO”) who manages imbedding cybersecurity in the Company’s products and services as they are being developed.
The Company’s CIO, CISO, and cybersecurity team collectively have decades of experience in various roles managing information security, developing cybersecurity strategy, and implementing, planning and operationalizing a comprehensive global IT infrastructure. Our CIO and CISO maintain relevant degrees, certifications, and trainings while also being recognized as experts in their respective fields by industry leaders.
The Company also conducts ongoing cyber security reviews which includes updates on the Company’s enterprise cybersecurity risk and product cybersecurity risk. Risk is assessed utilizing internal key performance indicators and external evaluations to determine the Company’s cybersecurity score in comparison to its peer group. Wabtec's Board of Directors participates in all enterprise annual security awareness training and phishing campaigns. Throughout the year, as appropriate, in addition to regularly scheduled updates, the Audit Committee, CIO, and CISO maintain an ongoing dialogue regarding the Company’s cybersecurity risk and posture. The cybersecurity framework is also supported by Wabtec's broader enterprise risk management process to ensure alignment of the Company’s cybersecurity efforts with the Company’s overall enterprise risk management.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Company’s CIO, CISO, and cybersecurity team collectively have decades of experience in various roles managing information security, developing cybersecurity strategy, and implementing, planning and operationalizing a comprehensive global IT infrastructure.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Senior Vice-President and Chief Information Officer (“CIO”) and Chief Information Security Officer (“CISO”) provide ongoing and continuing reports to the Audit Committee, which includes information about cyber-risk management, the effectiveness of the Company’s cybersecurity framework, and benchmarking the Company against its industry peers. The CISO is responsible for navigating cyber risks, data access governance, security governance and global regulatory compliance related to cybersecurity regulations and industry standards. The Company also has a Chief Product Security Officer (“CPSO”) who manages imbedding cybersecurity in the Company’s products and services as they are being developed.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true