XML 62 R31.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We are committed to our goal to protect sensitive business-related and personal information, as well as our information systems. Due to the size and scope of our global operations, we are subject to numerous and evolving cybersecurity risks that could adversely and materially affect our business, financial condition and results of operations.

Our Management Leadership Team, with oversight from the Board of Directors, has implemented a comprehensive cybersecurity program, including incident response process, aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and NIST Computer Security Incident Handling Guide (NIST SP 800-61) to assess, identify, address and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity and availability of our business and information systems.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
Cybersecurity risk management is overseen both as a critical component of our overall risk management program and as a standalone program. We have implemented a risk-based, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

Our cybersecurity program is designed to leverage people, processes, and technology to identify and respond to cybersecurity threats in a timely manner. Our vendor cybersecurity risk management program supports the planning, automation, and management of cybersecurity risk with enrolled suppliers and other third parties, focusing on risk-based assessments. Our employees undergo annual security awareness training to enhance their understanding of cybersecurity threats and their ability to identify and escalate potential cybersecurity events. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.

We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which may include tabletop exercises to test our preparedness and incident response process, business unit assessments, control gap analyses, threat modeling, penetration tests, vulnerability scanning, internal audits, and external audits of our cybersecurity program. We also leverage assessors, consultants, auditors and third-party service providers, including threat intelligence to inform our understanding of the cybersecurity threat landscape and enable risk-based measures to defend against evolving threats.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Our Board, in coordination with the Audit Committee, oversees the Company’s enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. Both the Board and the Audit Committee periodically review the measures we have implemented to identify and mitigate data protection and cybersecurity risks.

As part of such reviews, our Board and Audit Committee receive periodic reports and presentations from members of the team responsible for overseeing cybersecurity risk management, including our Chief Information Security Officer (CISO), which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to our peers and third parties. Members of our Management Leadership Team also report to the Board more frequently than annually on data protection and current internal and external developments in cybersecurity, as part of the Board’s enterprise risk management review, and the Board receives reports of Audit Committee discussions regarding its oversight of cybersecurity risk. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the Board in a timely manner.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] As part of such reviews, our Board and Audit Committee receive periodic reports and presentations from members of the team responsible for overseeing cybersecurity risk management, including our Chief Information Security Officer (CISO), which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to our peers and third parties.
Cybersecurity Risk Role of Management [Text Block]
At the management level, our CISO has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at Mondelēz and other major consumer goods and financial services companies. Our CISO currently reports to our Chief Information and Digital Officer and has operational responsibility for our information security programs, protections, and efforts, along with leading the team responsible for implementing, monitoring, and maintaining cybersecurity and data security strategy, policy, standards, architecture, and practices across our business. Our CISO is supported by a team of enterprise information system security and risk professionals, including regional information security officers responsible for overseeing cybersecurity strategy and operations in each business unit. Our CISO receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data security and cybersecurity risks. Our CISO updates the Management Leadership Team on these matters and works closely with Corporate and Legal Affairs to oversee compliance with legal, regulatory, and contractual security requirements.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
As part of such reviews, our Board and Audit Committee receive periodic reports and presentations from members of the team responsible for overseeing cybersecurity risk management, including our Chief Information Security Officer (CISO), which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to our peers and third parties. Members of our Management Leadership Team also report to the Board more frequently than annually on data protection and current internal and external developments in cybersecurity, as part of the Board’s enterprise risk management review, and the Board receives reports of Audit Committee discussions regarding its oversight of cybersecurity risk. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the Board in a timely manner.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] At the management level, our CISO has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at Mondelēz and other major consumer goods and financial services companies.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our CISO currently reports to our Chief Information and Digital Officer and has operational responsibility for our information security programs, protections, and efforts, along with leading the team responsible for implementing, monitoring, and maintaining cybersecurity and data security strategy, policy, standards, architecture, and practices across our business. Our CISO is supported by a team of enterprise information system security and risk professionals, including regional information security officers responsible for overseeing cybersecurity strategy and operations in each business unit. Our CISO receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data security and cybersecurity risks. Our CISO updates the Management Leadership Team on these matters and works closely with Corporate and Legal Affairs to oversee compliance with legal, regulatory, and contractual security requirements.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true