XML 23 R11.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management, Strategy, and Governance | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Item 1C. Cybersecurity. We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that could adversely and materially affect the confidentiality, integrity, and availability of our information and information systems. We maintain administrative, technical, and physical safeguards designed to protect the security and privacy of confidential, personal and proprietary information. Our cybersecurity program is aligned with notable control frameworks such as the NIST CSF (National Institute of Standards and Technology Cybersecurity Framework) and ISO (International Organization for Standardization) 27001. Our cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats. We have a global incident response capability supported by our Security Operations Center (which we refer to as SOC) team, a managed security service provider (MSSP) and our global Cybersecurity Incident Response Team (which we refer to as CSIRT), which provides threat detection and incident response. We maintain a global cybersecurity incident response plan and related playbooks, for execution by the SOC team and CSIRT, in coordination with internal and external stakeholders, as applicable. Significant incidents are escalated to a cross-departmental team to assess materiality based on qualitative and quantitative factors. This team consists of executives representing core business functions, including, among others, information technology, legal, finance, accounting, data protection and business divisions, in consultation with third-party advisors, as applicable. We undertake periodic leadership tabletop exercises and periodic adversarial (“red team”) exercises simulating incident response under common risk scenarios. As an acquisitive organization, we have also established a program to increase our visibility into the cybersecurity environment of acquisition targets prior to closing. We have established a dedicated vendor assessment team, which employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or that otherwise implicates the third-party technology and systems we use. We also require cybersecurity insurance coverage for vendors whose services or products may present a cybersecurity risk. We continuously test and assess our cybersecurity posture, including through annual third-party risk assessments performed by reputable assessors, consultants and auditors. A global FAIR (Factor Analysis of Information Risk) assessment is conducted at least annually to update our cybersecurity risks and corresponding mitigations. Our employees complete training on data security and our policies when they join us and annually thereafter. We review the content of our mandatory training annually, and provide access to a comprehensive set of supplemental training. Our Chief Information Security Officer (CISO), working together with our Chief Information Officer (CIO), oversees a team of employees dedicated to cybersecurity. Our CISO receives ongoing updates from the cybersecurity team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and regularly reports to the CIO. Our CISO is an active member of our management-level enterprise risk management committee, which has broad oversight of the company’s enterprise risks, including cybersecurity risks. In addition, our CIO and CISO both attend regular meetings of the executive officer team, including our Chief Executive Officer, Chief Financial Officer, General Counsel and other senior executive officers, dedicated to compliance and risk, and report on cybersecurity matters as appropriate. Our Board of Directors has delegated primary responsibility for the oversight of cybersecurity matters to its Risk and Compliance Committee; however, the full board reviews significant cybersecurity matters as appropriate. Our CIO and CISO report on cybersecurity and information security at each quarterly meeting of the Risk and Compliance Committee.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | Our CISO is an active member of our management-level enterprise risk management committee, which has broad oversight of the company’s enterprise risks, including cybersecurity risks.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] | We, including our third-party vendors, have experienced cybersecurity incidents and threats and may continue to experience them in the future. Based on the information available as of the date of this Annual Report on Form 10-K, we believe that during the last three fiscal years risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and as of the date of this Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that the Company will not be materially affected by such risks in the future. Due to evolving cybersecurity threats, we may not be able to protect all information systems and, as an acquisitive organization, integrating information systems as we acquire new businesses may expose us to unexpected liabilities or increase our vulnerability. There can be no guarantee that our policies, programs and controls, and those of our third-party vendors, including those described in this section, will be sufficient to protect our information, information systems or other property. Additional information on cybersecurity risks we face is discussed in Item 1A of Part I, “Risk Factors,” which should be read in conjunction with the foregoing information.
Cybersecurity Risk Board of Directors Oversight [Text Block] | Our Board of Directors has delegated primary responsibility for the oversight of cybersecurity matters to its Risk and Compliance Committee; however, the full board reviews significant cybersecurity matters as appropriate. Our CIO and CISO report on cybersecurity and information security at each quarterly meeting of the Risk and Compliance Committee.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our Board of Directors has delegated primary responsibility for the oversight of cybersecurity matters to its Risk and Compliance Committee
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our CISO receives ongoing updates from the cybersecurity team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and regularly reports to the CIO. Our CISO is an active member of our management-level enterprise risk management committee, which has broad oversight of the company’s enterprise risks, including cybersecurity risks. In addition, our CIO and CISO both attend regular meetings of the executive officer team, including our Chief Executive Officer, Chief Financial Officer, General Counsel and other senior executive officers, dedicated to compliance and risk, and report on cybersecurity matters as appropriate. Our Board of Directors has delegated primary responsibility for the oversight of cybersecurity matters to its Risk and Compliance Committee; however, the full board reviews significant cybersecurity matters as appropriate. Our CIO and CISO report on cybersecurity and information security at each quarterly meeting of the Risk and Compliance Committee.
Cybersecurity Risk Role of Management [Text Block] | Our Chief Information Security Officer (CISO), working together with our Chief Information Officer (CIO), oversees a team of employees dedicated to cybersecurity. Our CISO receives ongoing updates from the cybersecurity team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and regularly reports to the CIO. Our CISO is an active member of our management-level enterprise risk management committee, which has broad oversight of the company’s enterprise risks, including cybersecurity risks. In addition, our CIO and CISO both attend regular meetings of the executive officer team, including our Chief Executive Officer, Chief Financial Officer, General Counsel and other senior executive officers, dedicated to compliance and risk, and report on cybersecurity matters as appropriate.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | In addition, our CIO and CISO both attend regular meetings of the executive officer team, including our Chief Executive Officer, Chief Financial Officer, General Counsel and other senior executive officers, dedicated to compliance and risk, and report on cybersecurity matters as appropriate. Our Board of Directors has delegated primary responsibility for the oversight of cybersecurity matters to its Risk and Compliance Committee; however, the full board reviews significant cybersecurity matters as appropriate. Our CIO and CISO report on cybersecurity and information security at each quarterly meeting of the Risk and Compliance Committee.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our CIO has more than 30 years of experience, including from his prior business and technology leadership roles at Aegon N.V., Citigroup, Inc. and JP Morgan Chase & Company. Our CISO has more than 20 years of cybersecurity experience. Prior to joining us, he was Senior Vice President, Chief Information Security Officer at Brighthouse Financial. Before then, he served as Technology Vice President & Chief Information Security Officer for GE Healthcare. He started his career at Allstate Insurance Company. He also holds security, privacy and risk certifications, including Certified Information Systems Auditor, Certified Information Security Manager and Certified Information Systems Security Professional.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Our CISO receives ongoing updates from the cybersecurity team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and regularly reports to the CIO.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration