XML 56 R36.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage the cybersecurity risks that are relevant to our business. Our cybersecurity risk management program is integrated into, and forms an integral part of, our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. We have established a proactive approach to identify and manage material cybersecurity threats which includes, but is not limited to, the following: •An end-user cybersecurity awareness program that requires annual training completion, monthly simulated phishing emails to assess user susceptibility and provide training on emerging threats, and ongoing awareness communications throughout the year to reinforce learnings and raise awareness of specific, actively exploited threat vectors; •Security policies and practices aligned with NIST Special Publication 800-171, Revision 2 (NIST 800-171 Rev 2) and the organization’s enterprise risk management requirements; •Annual cybersecurity reporting and strategic update to ITT's Board of Directors; •Enterprise-wide centralized Security Information and Event Management (SIEM); •Regular red-team attack simulations led by industry-leading third-party cybersecurity firms; •Continuous internal and external facing vulnerability management scanning; •Threat intelligence feeds from various external sources (fee and non-fee based); •Threat hunting; •Strategically deployed artificial intelligence-based threat detection technology; •Cyber risk assessment and classification processes; •Cyber threat tabletop simulation exercises; •Cyber Incident Response Plan processes; •Externally led, targeted threat hunting exercises; •Engagement of forensic cybersecurity and data analysis firms (as needed) to conduct independent validation assessments if a breach is suspected and/or validated; •Engagements with third party consultants to build, design, and improve cyber risk management tools and processes; •Third-party technology and service provider risk evaluation process; and •Cybersecurity insurance coverage. During 2024, there were no cybersecurity incidents that had a material effect on the Company. Furthermore, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us to date, including our business, business strategy, results of operations, or financial condition. For a discussion of prospective risks related to potential cybersecurity incidents, please refer to Item 1A, Risk Factors.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | Our cybersecurity risk management program is integrated into, and forms an integral part of, our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] | For a discussion of prospective risks related to potential cybersecurity incidents, please refer to Item 1A, Risk Factors.
Cybersecurity Risk Board of Directors Oversight [Text Block] | Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management’s implementation of our cybersecurity risk management program and discusses with management the Company's cybersecurity and other information technology risks, controls, and procedures. The Board receives annual reports from management on our cybersecurity risks and strategic updates. These reports are designed to provide the Board a view into the progress of previous efforts, an update on existing and new material risks, and an overview of proposed or planned cybersecurity-related projects, and foster a discussion of cyber threats trending within the industry and their applicability to the organization. If a new material risk is identified, or if the Company is impacted by a material security incident, the Audit Committee and the full Board of Directors are notified and apprised of developments. ITT employs a team of certified cybersecurity professionals responsible for assessing and managing cybersecurity risks, led by the Chief Information Security Officer (CISO), who altogether make up ITT’s Cyber Security Operations Center (CSOC). The qualifications of our cybersecurity team include the following industry-recognized certifications: ISC2 Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Certified Ethical Hacker (C|EH), Security+, and IAPP Certified Information Privacy Professional (CIPP/US). Additionally, our cybersecurity team possesses several certifications from the SANS Institute’s Global Information Assurance Certification (GIAC) program, the top cybersecurity accreditation body in the world. These include GIAC Incident Handler Certification (GCIH), GIAC Certified Systems and Network Auditor (GSNA), GIAC Foundational Cybersecurity Technologies (GFACT) and others. The CSOC monitors the global ITT landscape for cyber threats, provides prevention strategies, initiates incident response for detected intrusions, and prescribes proactive and reactive mitigation strategies. The CSOC serves as the cornerstone for protecting, assessing, and managing cybersecurity risks for the enterprise, which includes, but is not limited to, back-office processes, critical manufacturing processes, intellectual property, and sensitive data. The CISO reports to the Chief Information Officer (CIO), who in turn reports to the Chief Financial Officer (CFO). The CIO has over 21 years of experience in information technology, including 14 years at ITT, while the CISO brings over 28 years of experience in information technology, with the last 22 years focused on information security and cybersecurity across various industries. The combined expertise and qualifications of our cybersecurity team enable us to effectively monitor, assess, and respond to cybersecurity threats. Management is actively informed about, and monitors, cybersecurity incidents, including their prevention, detection, mitigation, and remediation, through defined processes and reporting mechanisms. This proactive approach includes the alignment of security policies and practices with NIST 800-171 Rev 2 and the organization's enterprise risk management requirements. Twice annually, the CFO and CEO are briefed by the CISO and CIO regarding ongoing projects, investments and changes to the threat landscape that have impacted, or may impact, the organization, ensuring that the highest levels of management are kept abreast of the Company's cybersecurity posture. Overall, this comprehensive approach ensures that management is well-informed and actively involved in safeguarding the Company from cybersecurity threats.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management’s implementation of our cybersecurity risk management program and discusses with management the Company's cybersecurity and other information technology risks, controls, and procedures.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Board receives annual reports from management on our cybersecurity risks and strategic updates. These reports are designed to provide the Board a view into the progress of previous efforts, an update on existing and new material risks, and an overview of proposed or planned cybersecurity-related projects, and foster a discussion of cyber threats trending within the industry and their applicability to the organization. If a new material risk is identified, or if the Company is impacted by a material security incident, the Audit Committee and the full Board of Directors are notified and apprised of developments.
Cybersecurity Risk Role of Management [Text Block] | ITT employs a team of certified cybersecurity professionals responsible for assessing and managing cybersecurity risks, led by the Chief Information Security Officer (CISO), who altogether make up ITT’s Cyber Security Operations Center (CSOC). The qualifications of our cybersecurity team include the following industry-recognized certifications: ISC2 Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Certified Ethical Hacker (C|EH), Security+, and IAPP Certified Information Privacy Professional (CIPP/US). Additionally, our cybersecurity team possesses several certifications from the SANS Institute’s Global Information Assurance Certification (GIAC) program, the top cybersecurity accreditation body in the world. These include GIAC Incident Handler Certification (GCIH), GIAC Certified Systems and Network Auditor (GSNA), GIAC Foundational Cybersecurity Technologies (GFACT) and others. The CSOC monitors the global ITT landscape for cyber threats, provides prevention strategies, initiates incident response for detected intrusions, and prescribes proactive and reactive mitigation strategies. The CSOC serves as the cornerstone for protecting, assessing, and managing cybersecurity risks for the enterprise, which includes, but is not limited to, back-office processes, critical manufacturing processes, intellectual property, and sensitive data. The CISO reports to the Chief Information Officer (CIO), who in turn reports to the Chief Financial Officer (CFO). The CIO has over 21 years of experience in information technology, including 14 years at ITT, while the CISO brings over 28 years of experience in information technology, with the last 22 years focused on information security and cybersecurity across various industries. The combined expertise and qualifications of our cybersecurity team enable us to effectively monitor, assess, and respond to cybersecurity threats. Management is actively informed about, and monitors, cybersecurity incidents, including their prevention, detection, mitigation, and remediation, through defined processes and reporting mechanisms. This proactive approach includes the alignment of security policies and practices with NIST 800-171 Rev 2 and the organization's enterprise risk management requirements. Twice annually, the CFO and CEO are briefed by the CISO and CIO regarding ongoing projects, investments and changes to the threat landscape that have impacted, or may impact, the organization, ensuring that the highest levels of management are kept abreast of the Company's cybersecurity posture. Overall, this comprehensive approach ensures that management is well-informed and actively involved in safeguarding the Company from cybersecurity threats.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | ITT employs a team of certified cybersecurity professionals responsible for assessing and managing cybersecurity risks, led by the Chief Information Security Officer (CISO), who altogether make up ITT’s Cyber Security Operations Center (CSOC). The qualifications of our cybersecurity team include the following industry-recognized certifications: ISC2 Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Certified Ethical Hacker (C|EH), Security+, and IAPP Certified Information Privacy Professional (CIPP/US). Additionally, our cybersecurity team possesses several certifications from the SANS Institute’s Global Information Assurance Certification (GIAC) program, the top cybersecurity accreditation body in the world. These include GIAC Incident Handler Certification (GCIH), GIAC Certified Systems and Network Auditor (GSNA), GIAC Foundational Cybersecurity Technologies (GFACT) and others. The CSOC monitors the global ITT landscape for cyber threats, provides prevention strategies, initiates incident response for detected intrusions, and prescribes proactive and reactive mitigation strategies. The CSOC serves as the cornerstone for protecting, assessing, and managing cybersecurity risks for the enterprise, which includes, but is not limited to, back-office processes, critical manufacturing processes, intellectual property, and sensitive data. The CISO reports to the Chief Information Officer (CIO), who in turn reports to the Chief Financial Officer (CFO).
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The CIO has over 21 years of experience in information technology, including 14 years at ITT, while the CISO brings over 28 years of experience in information technology, with the last 22 years focused on information security and cybersecurity across various industries.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Management is actively informed about, and monitors, cybersecurity incidents, including their prevention, detection, mitigation, and remediation, through defined processes and reporting mechanisms. This proactive approach includes the alignment of security policies and practices with NIST 800-171 Rev 2 and the organization's enterprise risk management requirements. Twice annually, the CFO and CEO are briefed by the CISO and CIO regarding ongoing projects, investments and changes to the threat landscape that have impacted, or may impact, the organization, ensuring that the highest levels of management are kept abreast of the Company's cybersecurity posture. Overall, this comprehensive approach ensures that management is well-informed and actively involved in safeguarding the Company from cybersecurity threats.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration