XML 55 R33.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Cybersecurity risk is a part of our overall enterprise risk management assessment. Our cybersecurity program is modeled on the National Institute of Security Technology Cybersecurity Framework (NIST CSF) which provides the governance structure for our identification of, protection against, detection of, response to and recovery from cybersecurity threats and incidents, including those associated with our use of third-party applications and service providers.
Key components of our cybersecurity program include:
•an enterprise organizational framework that consists of enterprise leaders that oversee our cybersecurity governance, including policies and standards, and functional business unit leaders that implement our cybersecurity policies;
•the identification of our cybersecurity risks and vulnerabilities and the implementation of protections against cybersecurity threats and incidents, including regular training to our employees;

•continual global threat monitoring and detection, in partnership with third-party service providers;
•a process for assessing the severity of cybersecurity threats, identifying whether the cybersecurity threats are associated with a third-party service provider, and implementing an appropriate response and resolution to cybersecurity incidents, as necessary; and
•risk-based cybersecurity audits led by our internal audit function, which include cybersecurity control maturity assessments (based on NIST CSF), as well as attack simulations and penetration testing performed by third-party service providers.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
Cybersecurity risk is a part of our overall enterprise risk management assessment. Our cybersecurity program is modeled on the National Institute of Security Technology Cybersecurity Framework (NIST CSF) which provides the governance structure for our identification of, protection against, detection of, response to and recovery from cybersecurity threats and incidents, including those associated with our use of third-party applications and service providers.
Key components of our cybersecurity program include:
•an enterprise organizational framework that consists of enterprise leaders that oversee our cybersecurity governance, including policies and standards, and functional business unit leaders that implement our cybersecurity policies;
•the identification of our cybersecurity risks and vulnerabilities and the implementation of protections against cybersecurity threats and incidents, including regular training to our employees;

•continual global threat monitoring and detection, in partnership with third-party service providers;
•a process for assessing the severity of cybersecurity threats, identifying whether the cybersecurity threats are associated with a third-party service provider, and implementing an appropriate response and resolution to cybersecurity incidents, as necessary; and
•risk-based cybersecurity audits led by our internal audit function, which include cybersecurity control maturity assessments (based on NIST CSF), as well as attack simulations and penetration testing performed by third-party service providers.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Our Board of Directors has overall oversight responsibility for our enterprise risk management and compliance programs, including cybersecurity. Our Board is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which we are exposed, implement the appropriate protections to address such risks, identify cybersecurity threats and respond to and resolve cybersecurity incidents.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Board is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which we are exposed, implement the appropriate protections to address such risks, identify cybersecurity threats and respond to and resolve cybersecurity incidents.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] At least annually, our Vice President, Information Technology discusses with our Board a report on cybersecurity, including an update regarding our cybersecurity risks, mitigation activities and industry developments
Cybersecurity Risk Role of Management [Text Block] Management is responsible for identifying and assessing material cybersecurity risks on an ongoing basis and for developing, managing and implementing our cybersecurity program to assure that our potential cybersecurity risk exposures are monitored and appropriate mitigation measures are implemented.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] At least annually, our Vice President, Information Technology discusses with our Board a report on cybersecurity, including an update regarding our cybersecurity risks, mitigation activities and industry developments.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our cybersecurity program is overseen by our Vice President, Information Technology and our Director, Cybersecurity. Our Vice President, Information Technology has significant professional experience in leading the information technology function and our Director, Cybersecurity has held various roles in cybersecurity and is an ISC2 Certified Information Security Professional (CISSP®). Each periodically participates in various industry cyber forums and communicates industry best practices to the appropriate internal information security professionals.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] At least annually, our Vice President, Information Technology discusses with our Board a report on cybersecurity, including an update regarding our cybersecurity risks, mitigation activities and industry developments. In addition, our internal audit function provides regular updates to our Audit Committee on the results of our cybersecurity audits and related mitigation activities.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true