XML 51 R33.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | RISK MANAGEMENT AND STRATEGY We take an enterprise approach to information security risk management and governance. Our information security program and framework comprise processes, policies, practices, systems, and technologies that are designed to identify, assess, prioritize, manage, and monitor risks to our information systems, including risks from cybersecurity threats and events and risks associated with the use of third-party service providers. Our established recovery approach is designed to provide for the ready availability and use of our business-critical processes in the event of any downtime, disaster, or outages. We also seek to identify and mitigate the risks associated with the use of third-party service providers through the review of their security programs prior to our engagement thereof. Additionally, our control environment and internal audit process are designed to bring a systematic, disciplined approach to evaluate our risk management, control, and governance processes concerning cybersecurity and our information security framework. We have a cybersecurity Incident Response Plan (IRP) that sets forth a process designed to effectively respond to an incident by obtaining information, coordinating activities, assessing results, and communicating applicable developments to our stakeholders, including employees, law enforcement, other external parties and agencies, and our Board. The IRP includes the following major components: preparation, detection and analysis, containment, eradication, notification, recovery, reporting, and lessons learned. Specific technical and legal playbooks have also been developed for data breaches, malware, unauthorized remote access, and ransomware. We have also retained certain third-party experts to assist us with various aspects of incident assessment and response in the event those services become necessary or useful. Typically, we (i) perform periodic tabletop exercises with a company-wide cross-functional team that are facilitated by a third-party expert and are intended to simulate a real-life security incident, (ii) conduct penetration testing as needed and annually conduct Payment Card Industry Data Security Standard testing and firewall reviews, and have periodically engaged a third-party expert to help therewith, (iii) hold annual cybersecurity awareness trainings, and (iv) periodically engage a third-party expert to conduct a review of our information security framework, which is designed to help identify existing and emerging risks, and mitigate against such risks. These internal efforts and external third-party reviews also support our efforts to regularly assess our information security program and framework against emerging risks, market and industry developments and provide opportunities to make adjustments or enhancements when deemed prudent or necessary. In 2024, we established a company-wide cross-functional team to preliminarily assess the risks and opportunities from conventional and generative AI and will continue these assessments in 2025. To date, there have been no cybersecurity incidents that have materially affected us, or that are reasonably likely to materially affect us, including our business strategy, financial condition, or results of operations.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | We take an enterprise approach to information security risk management and governance. Our information security program and framework comprise processes, policies, practices, systems, and technologies that are designed to identify, assess, prioritize, manage, and monitor risks to our information systems, including risks from cybersecurity threats and events and risks associated with the use of third-party service providers.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Our Board’s Role in Cybersecurity Oversight Oversight of risk management, including with respect to risks from cybersecurity threats, is the responsibility of our Board, which exercises its oversight responsibilities both directly and through its committees. The Audit Committee of our Board has formal oversight responsibilities established in its committee charter concerning our initiatives and strategies respecting cybersecurity and information technology risks. At least once annually, the heads of our information services and internal audit teams provide a report to the Audit Committee on cybersecurity and information technology risks, as well as our information security operations, structure, framework, various cybersecurity and information technology metrics, our cybersecurity and information security management and improvement efforts, future projects, and our governance and assessments related to cybersecurity and information technology. The chair of the Audit Committee reports to the Board a summary of the information presented by the heads of our information services and internal audit teams during their cybersecurity update. Periodically, the Board also receives reports on such matters directly. As noted above, the IRP also contains notification procedures to the Board.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Audit Committee of our Board has formal oversight responsibilities established in its committee charter concerning our initiatives and strategies respecting cybersecurity and information technology risks.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | At least once annually, the heads of our information services and internal audit teams provide a report to the Audit Committee on cybersecurity and information technology risks, as well as our information security operations, structure, framework, various cybersecurity and information technology metrics, our cybersecurity and information security management and improvement efforts, future projects, and our governance and assessments related to cybersecurity and information technology. The chair of the Audit Committee reports to the Board a summary of the information presented by the heads of our information services and internal audit teams during their cybersecurity update. Periodically, the Board also receives reports on such matters directly. As noted above, the IRP also contains notification procedures to the Board.
Cybersecurity Risk Role of Management [Text Block] | Management’s Role in Assessment and Management of Material Risks from Cybersecurity Threats We have an Information Security Committee (Infosec Committee) consisting of refining, renewable diesel, ethanol, logistics, and information services personnel that meets weekly to evaluate third-party exchange of data and collaborate on strategy for dealing with information security risks and other related matters. The Infosec Committee reports to our Information Security Oversight Committee (Infosec Oversight Committee) and our Executive Steering Committee on cybersecurity (Executive Steering Committee). Our Infosec Oversight Committee consists of information services, refining, and internal audit personnel and meets quarterly to discuss network threats and the overall security landscape. Our Executive Steering Committee consists of management within our information services, internal audit, refining, renewable diesel, ethanol, legal, and logistics teams, and meets twice per year to review and discuss information security metrics and results of security assessments, among other items. Key members of the Infosec Oversight Committee and the Executive Steering Committee provide a report to the Audit Committee of the Board as discussed above. Our information services team is led by our Vice President-Information Services and Technology, who also chairs the Infosec Oversight Committee and has approximately 25 years of experience in the information technology industry. Collectively, the members of our Infosec Committee, Infosec Oversight Committee, and Executive Steering Committee have decades of experience within the information technology industry and/or cybersecurity areas. On a monthly basis, our Vice President-Information Services and Technology provides executive management with an Information Security Scorecard, which includes any cybersecurity events that have occurred. If a cybersecurity incident is declared under the IRP, we will evaluate whether such incident might have a material adverse impact on our business, financial condition, results of operations, or reputation, among other considerations, and communicate that discussion to executive management, who will then determine if escalation to the Board is warranted and if further disclosure is required to the SEC and/or other government agencies.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Management’s Role in Assessment and Management of Material Risks from Cybersecurity Threats We have an Information Security Committee (Infosec Committee) consisting of refining, renewable diesel, ethanol, logistics, and information services personnel that meets weekly to evaluate third-party exchange of data and collaborate on strategy for dealing with information security risks and other related matters. The Infosec Committee reports to our Information Security Oversight Committee (Infosec Oversight Committee) and our Executive Steering Committee on cybersecurity (Executive Steering Committee). Our Infosec Oversight Committee consists of information services, refining, and internal audit personnel and meets quarterly to discuss network threats and the overall security landscape. Our Executive Steering Committee consists of management within our information services, internal audit, refining, renewable diesel, ethanol, legal, and logistics teams, and meets twice per year to review and discuss information security metrics and results of security assessments, among other items. Key members of the Infosec Oversight Committee and the Executive Steering Committee provide a report to the Audit Committee of the Board as discussed above. On a monthly basis, our Vice President-Information Services and Technology provides executive management with an Information Security Scorecard, which includes any cybersecurity events that have occurred.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our information services team is led by our Vice President-Information Services and Technology, who also chairs the Infosec Oversight Committee and has approximately 25 years of experience in the information technology industry. Collectively, the members of our Infosec Committee, Infosec Oversight Committee, and Executive Steering Committee have decades of experience within the information technology industry and/or cybersecurity areas.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | We have a cybersecurity Incident Response Plan (IRP) that sets forth a process designed to effectively respond to an incident by obtaining information, coordinating activities, assessing results, and communicating applicable developments to our stakeholders, including employees, law enforcement, other external parties and agencies, and our Board.If a cybersecurity incident is declared under the IRP, we will evaluate whether such incident might have a material adverse impact on our business, financial condition, results of operations, or reputation, among other considerations, and communicate that discussion to executive management, who will then determine if escalation to the Board is warranted and if further disclosure is required to the SEC and/or other government agencies.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration