XML 33 R11.htm IDEA: XBRL DOCUMENT
v3.25.3

Cybersecurity Risk Management, Strategy and Governance | 12 Months Ended
--- | ---
Sep. 30, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | # Item 1C. Cybersecurit y # Cybersecurity Risk Management and Strategy We maintain a cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework to assess, identify, and manage cybersecurity risks. This program is designed to protect business continuity and preserve the confidentiality, integrity, and continued availability of our IT systems and infrastructure used in our business as well as the information that we own or is in our care and is integrated into our overall enterprise risk management program. We have established processes to evaluate and address cybersecurity risks on an ongoing basis. As part of our risk management program, we engage with external third parties to measure the effectiveness of our cybersecurity program through penetration tests, control assessments, tabletop exercises, and other related activities. Further, we have implemented a defense-in-depth strategy in which we utilize real-time 24/7 monitoring to identify anomalies, potential threats, and alerts. This cybersecurity strategy incorporates frameworks, policies, and practices designed to protect the privacy and security of our sensitive information, backed by a suite of security technologies and tools to implement and automate select security protections. We maintain cyber risk and related insurance policies as a measure of added protection. We educate our members to raise awareness of cybersecurity threats. As part of our program, we maintain annual training for all members on cybersecurity standards and provide training on how to recognize and properly respond to phishing, social engineering schemes, and certain other cyber threats. We equip our members with a mechanism to easily report suspicious emails which are analyzed by our security systems and dedicated incident response team. We periodically send “Test” phishing assessments to our members. Any failures trigger a retraining exercise. Also, we have specific and regular training for our IT and finance members, as well as our system administrators. In addition, we maintain processes governing interconnections with third-party systems and we perform due diligence procedures before onboarding service providers with access to our systems or processing sensitive data on our behalf. This process includes, as applicable and appropriate based on risk profile and criticality, a review of System and Organization Controls ("SOC") 1 and SOC 2 reports (as each such report is defined by the American Institute of Certified Public Accountants), ISO 27001 certifications, and/or Cybersecurity Maturity Model Certifications, as well as reviewing penetration tests, conducting vulnerability tests, and administering security questionnaires and assessments. We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial conditi on. However, risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. Nonetheless, our IT infrastructure, systems, networks, products, solutions, and services remain vulnerable to numerous additional known or unknown threats. For more information about the cybersecurity risks we face, please refer to Item 1A, “Risk Factors,” in this Form 10-K, including the risk factor entitled “Our business and operations may be adversely affected by cybersecurity breaches or other information technology system or network interruptions or intrusions.” # Cybersecurity Governance Our cybersecurity program is ultimately overseen by the Board of Directors (the "Board"). The Audit Committee has responsibility for the oversight of risk management activities related to cybersecurity and other information security and technology risks. Our cybersecurity program is implemented and administered by a dedicated team of internal and external cybersecurity professionals that conduct periodic control gap assessments, maturity assessments, and benchmarking against peers in the industry, monitor various security tools deployed in the IT environment and review threat intelligence and other information from various public and private sources. The team has decades of experience with varied certifications and is led by our Chief Information Security Officer ("CISO"), who reports to our Vice President of IT, has over 18 years of experience as an IT professional and in cybersecurity, including experience leading cybersecurity programs protecting high value assets and critical infrastructure, including in high-risk locations. Our Vice President of IT has been a key leader in our IT group for more than 25 years, including the last seven in his current role leading our IT function. He plays an integral role in cybersecurity risk assessment and mitigation in all corporate acquisitions, and he participated in the development and implementation of our initial cybersecurity program more than 20 years ago. Our CISO and Vice President of IT are primarily responsible for assessing and managing risks from cybersecurity threats to the Company. The CISO and Vice President of IT make regular reports to senior management regarding the cybersecurity program. We also have a notification process for appropriate escalation of cyber incidents by members of our internal cybersecurity team to senior management as appropriate, including our Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer, and/or General Counsel, as well as to the Audit Committee. The senior management team, including the CISO and Vice President of IT, provides quarterly data protection and cybersecurity reports to the Audit Committee, as well as periodic reports to the full Board of Directors, which include information about cyber risk management, the cybersecurity risk environment, and the status of ongoing efforts to strengthen cybersecurity effectiveness.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | We maintain a cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework to assess, identify, and manage cybersecurity risks. This program is designed to protect business continuity and preserve the confidentiality, integrity, and continued availability of our IT systems and infrastructure used in our business as well as the information that we own or is in our care and is integrated into our overall enterprise risk management program.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Our cybersecurity program is ultimately overseen by the Board of Directors (the "Board"). The Audit Committee has responsibility for the oversight of risk management activities related to cybersecurity and other information security and technology risks. Our cybersecurity program is implemented and administered by a dedicated team of internal and external cybersecurity professionals that conduct periodic control gap assessments, maturity assessments, and benchmarking against peers in the industry, monitor various security tools deployed in the IT environment and review threat intelligence and other information from various public and private sources. The team has decades of experience with varied certifications and is led by our Chief Information Security Officer ("CISO"), who reports to our Vice President of IT, has over 18 years of experience as an IT professional and in cybersecurity, including experience leading cybersecurity programs protecting high value assets and critical infrastructure, including in high-risk locations. Our Vice President of IT has been a key leader in our IT group for more than 25 years, including the last seven in his current role leading our IT function. He plays an integral role in cybersecurity risk assessment and mitigation in all corporate acquisitions, and he participated in the development and implementation of our initial cybersecurity program more than 20 years ago.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Audit Committee has responsibility for the oversight of risk management activities related to cybersecurity and other information security and technology risks.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our cybersecurity program is implemented and administered by a dedicated team of internal and external cybersecurity professionals that conduct periodic control gap assessments, maturity assessments, and benchmarking against peers in the industry, monitor various security tools deployed in the IT environment and review threat intelligence and other information from various public and private sources.
Cybersecurity Risk Role of Management [Text Block] | Our CISO and Vice President of IT are primarily responsible for assessing and managing risks from cybersecurity threats to the Company. The CISO and Vice President of IT make regular reports to senior management regarding the cybersecurity program. We also have a notification process for appropriate escalation of cyber incidents by members of our internal cybersecurity team to senior management as appropriate, including our Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer, and/or General Counsel, as well as to the Audit Committee. The senior management team, including the CISO and Vice President of IT, provides quarterly data protection and cybersecurity reports to the Audit Committee, as well as periodic reports to the full Board of Directors, which include information about cyber risk management, the cybersecurity risk environment, and the status of ongoing efforts to strengthen cybersecurity effectiveness.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | We also have a notification process for appropriate escalation of cyber incidents by members of our internal cybersecurity team to senior management as appropriate, including our Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer, and/or General Counsel, as well as to the Audit Committee.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The team has decades of experience with varied certifications and is led by our Chief Information Security Officer ("CISO"), who reports to our Vice President of IT, has over 18 years of experience as an IT professional and in cybersecurity, including experience leading cybersecurity programs protecting high value assets and critical infrastructure, including in high-risk locations. Our Vice President of IT has been a key leader in our IT group for more than 25 years, including the last seven in his current role leading our IT function. He plays an integral role in cybersecurity risk assessment and mitigation in all corporate acquisitions, and he participated in the development and implementation of our initial cybersecurity program more than 20 years ago.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The senior management team, including the CISO and Vice President of IT, provides quarterly data protection and cybersecurity reports to the Audit Committee, as well as periodic reports to the full Board of Directors, which include information about cyber risk management, the cybersecurity risk environment, and the status of ongoing efforts to strengthen cybersecurity effectiveness.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration