XML 56 R29.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | The Risk Committee oversees the Company’s approach to cybersecurity risk assessment and mitigation by, among other things, (i) reviewing the Company’s cybersecurity insurance program, (ii) reviewing the Company’s cybersecurity budget, (iii) discussing the results of various internal cybersecurity audits and periodic independent third-party assessments of the Company’s cybersecurity programs, (iv) being briefed on cybersecurity matters by outside experts, and (v) receiving regular updates from the Company’s Chief Information Security Officer (“CISO”) and others on cybersecurity risks, operational metrics, compliance and regulatory developments, training programs, risk mitigation activities, key projects and industry developments. The Company's Chief Legal and Compliance Officer ("CLCO"), Chief Digital and Technology Officer ("CDTO"), CISO and Vice President of Compliance and Internal Audit participate in Risk Committee meetings and meet individually with the Risk Committee on a periodic basis to discuss and address relevant matters, including the Company’s approach to cybersecurity risk assessment and mitigation. The CISO reports to the CDTO, who in turn reports to the Chief Executive Officer ("CEO"). The CISO has more than thirty years of IT experience, has served many years in various information security management roles and has multiple cybersecurity certifications. The Company maintains an enterprise risk management process designed to identify potential events that may affect the achievement of the Company's objectives or have a material adverse effect on the Company. Cybersecurity is among the risks considered as a part of this process. The Company's management, including the CISO, also participates on the Company's Information Security & Privacy Governance Council (“ISPGC”). The ISPGC meets periodically to consider information security and privacy matters. The Company utilizes various technical and qualitative processes to assist in identifying, assessing and managing cybersecurity risks. The Company's processes include periodic discussions and risk reviews with management. These processes also include, depending on facts and circumstances, internal audits, third-party assessments, post-remediation reviews, engagements with independent third-party service providers and key governmental agencies, regular employee training, an incident response plan and backup and recovery plans. Our periodic engagements with independent third-party service providers are designed to provide qualitative and technical cybersecurity assessments. The Company has a corporate-level cybersecurity team, led by the CISO, that, among other responsibilities, receives and reviews reports regarding potential threats, trends and remediation strategies. The cybersecurity team evaluates threat intelligence and information obtained from various sources, including internal, public or private sources, government agencies and external consultants. Certain of the Company's subsidiaries have separate cybersecurity teams that, along with the corporate-level cybersecurity team, play a role in the Company's efforts to monitor, identify, assess and manage cybersecurity risks. The Company interacts with the information technology networks and systems of third parties for many aspects of our business. We consider and evaluate cybersecurity risks associated with the use of independent third-party service providers. To help UPS understand and mitigate potential cybersecurity risks related to third parties, we generally utilize measures such as vendor risk assessments, periodic technical assessments of third-party vendors' controls and contracts governing the use of and access to our data and compliance with our security requirements. We maintain an Incident Response Plan that includes processes and procedures for reviewing and responding to cybersecurity incidents. We periodically test our readiness to respond to a cybersecurity incident through various scenario-based drills. The Incident Response Plan includes processes for escalation to the CISO, the Executive Leadership Team, including the CEO, the Risk Committee and the Board, and a process for consideration of whether a cybersecurity incident is material and may require disclosure in SEC filings.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | The Company maintains an enterprise risk management process designed to identify potential events that may affect the achievement of the Company's objectives or have a material adverse effect on the Company.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | The Board has appointed a Risk Committee, consisting entirely of independent directors, whose responsibilities include assisting the Board in overseeing management’s identification and evaluation of strategic enterprise risks, including risks associated with privacy, technology, information security, cybersecurity and cyber incident response and business continuity. The Risk Committee regularly updates the Board on these activities.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Board has appointed a Risk Committee, consisting entirely of independent directors, whose responsibilities include assisting the Board in overseeing management’s identification and evaluation of strategic enterprise risks, including risks associated with privacy, technology, information security, cybersecurity and cyber incident response and business continuity.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Company utilizes various technical and qualitative processes to assist in identifying, assessing and managing cybersecurity risks. The Company's processes include periodic discussions and risk reviews with management. These processes also include, depending on facts and circumstances, internal audits, third-party assessments, post-remediation reviews, engagements with independent third-party service providers and key governmental agencies, regular employee training, an incident response plan and backup and recovery plans. Our periodic engagements with independent third-party service providers are designed to provide qualitative and technical cybersecurity assessments. The Company has a corporate-level cybersecurity team, led by the CISO, that, among other responsibilities, receives and reviews reports regarding potential threats, trends and remediation strategies. The cybersecurity team evaluates threat intelligence and information obtained from various sources, including internal, public or private sources, government agencies and external consultants. Certain of the Company's subsidiaries have separate cybersecurity teams that, along with the corporate-level cybersecurity team, play a role in the Company's efforts to monitor, identify, assess and manage cybersecurity risks.
Cybersecurity Risk Role of Management [Text Block] | The Risk Committee oversees the Company’s approach to cybersecurity risk assessment and mitigation by, among other things, (i) reviewing the Company’s cybersecurity insurance program, (ii) reviewing the Company’s cybersecurity budget, (iii) discussing the results of various internal cybersecurity audits and periodic independent third-party assessments of the Company’s cybersecurity programs, (iv) being briefed on cybersecurity matters by outside experts, and (v) receiving regular updates from the Company’s Chief Information Security Officer (“CISO”) and others on cybersecurity risks, operational metrics, compliance and regulatory developments, training programs, risk mitigation activities, key projects and industry developments. The Company's Chief Legal and Compliance Officer ("CLCO"), Chief Digital and Technology Officer ("CDTO"), CISO and Vice President of Compliance and Internal Audit participate in Risk Committee meetings and meet individually with the Risk Committee on a periodic basis to discuss and address relevant matters, including the Company’s approach to cybersecurity risk assessment and mitigation. The CISO reports to the CDTO, who in turn reports to the Chief Executive Officer ("CEO"). The CISO has more than thirty years of IT experience, has served many years in various information security management roles and has multiple cybersecurity certifications. The Company maintains an enterprise risk management process designed to identify potential events that may affect the achievement of the Company's objectives or have a material adverse effect on the Company. Cybersecurity is among the risks considered as a part of this process. The Company's management, including the CISO, also participates on the Company's Information Security & Privacy Governance Council (“ISPGC”). The ISPGC meets periodically to consider information security and privacy matters. The Company utilizes various technical and qualitative processes to assist in identifying, assessing and managing cybersecurity risks. The Company's processes include periodic discussions and risk reviews with management. These processes also include, depending on facts and circumstances, internal audits, third-party assessments, post-remediation reviews, engagements with independent third-party service providers and key governmental agencies, regular employee training, an incident response plan and backup and recovery plans. Our periodic engagements with independent third-party service providers are designed to provide qualitative and technical cybersecurity assessments. The Company has a corporate-level cybersecurity team, led by the CISO, that, among other responsibilities, receives and reviews reports regarding potential threats, trends and remediation strategies. The cybersecurity team evaluates threat intelligence and information obtained from various sources, including internal, public or private sources, government agencies and external consultants. Certain of the Company's subsidiaries have separate cybersecurity teams that, along with the corporate-level cybersecurity team, play a role in the Company's efforts to monitor, identify, assess and manage cybersecurity risks. The Company interacts with the information technology networks and systems of third parties for many aspects of our business. We consider and evaluate cybersecurity risks associated with the use of independent third-party service providers. To help UPS understand and mitigate potential cybersecurity risks related to third parties, we generally utilize measures such as vendor risk assessments, periodic technical assessments of third-party vendors' controls and contracts governing the use of and access to our data and compliance with our security requirements.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | The Board has appointed a Risk Committee, consisting entirely of independent directors, whose responsibilities include assisting the Board in overseeing management’s identification and evaluation of strategic enterprise risks, including risks associated with privacy, technology, information security, cybersecurity and cyber incident response and business continuity.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The CISO has more than thirty years of IT experience, has served many years in various information security management roles and has multiple cybersecurity certifications.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The Risk Committee oversees the Company’s approach to cybersecurity risk assessment and mitigation by, among other things, (i) reviewing the Company’s cybersecurity insurance program, (ii) reviewing the Company’s cybersecurity budget, (iii) discussing the results of various internal cybersecurity audits and periodic independent third-party assessments of the Company’s cybersecurity programs, (iv) being briefed on cybersecurity matters by outside experts, and (v) receiving regular updates from the Company’s Chief Information Security Officer (“CISO”) and others on cybersecurity risks, operational metrics, compliance and regulatory developments, training programs, risk mitigation activities, key projects and industry developments. The Company's Chief Legal and Compliance Officer ("CLCO"), Chief Digital and Technology Officer ("CDTO"), CISO and Vice President of Compliance and Internal Audit participate in Risk Committee meetings and meet individually with the Risk Committee on a periodic basis to discuss and address relevant matters, including the Company’s approach to cybersecurity risk assessment and mitigation.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration