XML 49 R32.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management Strategy And Governance [Abstract]  
Cybersecurity Risk Management Processes For Assessing Identifying And Managing Threats [Text Block]

Risk Management and Strategy

Our cybersecurity risk management process is integrated into our ERM process as described in Item 1A. Risk Factors. Cybersecurity has been identified as a critical risk.

To identify, assess, and manage material cybersecurity risks, we regularly evaluate and take steps to enhance our cybersecurity protocols to protect against or mitigate cyber threats. We conduct third-party and internal assessments of our environments, including system penetration testing, test our recovery and response processes, and we consider industry standards when developing our information security program. The Company has an information security training program, which calls for training all computer-based employees through various employee training modules relative to information security matters and phishing simulation events with employees to raise cybersecurity awareness.

From time to time, we engage third-party assessors, consultants, auditors and others to assist us with evaluating, enhancing, implementing and monitoring our cybersecurity risk-management programs. We maintain processes to oversee and identify cybersecurity risks associated with our use of third-party service providers such as contract and vendor due diligence review, as well as annual review of the service providers’ independent audit report where applicable.

Like many companies, our systems and those of our third party providers who provide us with services and products may be subject to cybersecurity threats and cybersecurity incidents. To date, no such cybersecurity incidents have had or are reasonably likely to have a material impact on our Company, including its business strategy, results of operations or financial condition. However, if as a result of any future incidents our systems are significantly damaged, cease to function properly or are subject to a significant cybersecurity incident, we may suffer an interruption in our ability to manage and operate the business, and our results of operations and financial condition could be adversely affected. The Company maintains an insurance policy with respect to cybersecurity and has undergone several simulation, preparedness and response exercises. See “Risks Related to Manufacturing and Operations” in Item 1A. Risk Factors.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]

From time to time, we engage third-party assessors, consultants, auditors and others to assist us with evaluating, enhancing, implementing and monitoring our cybersecurity risk-management programs. We maintain processes to oversee and identify cybersecurity risks associated with our use of third-party service providers such as contract and vendor due diligence review, as well as annual review of the service providers’ independent audit report where applicable.

Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight And Identification Processes [Flag] true
Cybersecurity Risk Materially Affected Or Reasonably Likely To Materially Affect Registrant [Flag] false
Cybersecurity Risk Board Of Directors Oversight [Text Block]

Governance

Our Board oversees the management of our risks, including risks from cybersecurity threats, on an enterprise-wide basis, and the Lead Independent Director promotes our Board’s engagement in this process. Our Board has delegated oversight of the risk assessment and mitigation process with respect to cybersecurity to the Audit Committee of our Board. The Audit Committee regularly monitors the Company’s cybersecurity risks and receives updates from the Chief Information Officer (“CIO”) at each meeting. In addition, the Audit Committee regularly reviews the overall effectiveness of the information technology security environment as part of quarterly updates provided by the CIO. The CIO reports to the full Board about cybersecurity on an annual basis.

Our CIO has over 25 years of experience in the Information Technology (“IT”) and cybersecurity industry. The CIO is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. On at least a quarterly basis, the CIO chairs the IT Governance Committee, which includes the executive management team. The purpose of this committee is to inform and make strategic decisions on IT-related matters, including the prevention, detection, mitigation and remediation of cybersecurity incidents. In addition, the CIO regularly reviews key cybersecurity risk metrics and reporting designed to measure the effectiveness of related processes and procedures as part of quarterly updates to the Audit Committee. The CIO utilizes this information in her reporting to the Board and Audit Committee of the Board.

Cybersecurity Risk Board Committee Or Subcommittee Responsible For Oversight [Text Block] Audit Committee of our Board
Cybersecurity Risk Process For Informing Board Committee Or Subcommittee Responsible For Oversight [Text Block] Our Board oversees the management of our risks, including risks from cybersecurity threats, on an enterprise-wide basis, and the Lead Independent Director promotes our Board’s engagement in this process. Our Board has delegated oversight of the risk assessment and mitigation process with respect to cybersecurity to the Audit Committee of our Board.
Cybersecurity Risk Role Of Management [Text Block]

Our Board oversees the management of our risks, including risks from cybersecurity threats, on an enterprise-wide basis, and the Lead Independent Director promotes our Board’s engagement in this process. Our Board has delegated oversight of the risk assessment and mitigation process with respect to cybersecurity to the Audit Committee of our Board. The Audit Committee regularly monitors the Company’s cybersecurity risks and receives updates from the Chief Information Officer (“CIO”) at each meeting. In addition, the Audit Committee regularly reviews the overall effectiveness of the information technology security environment as part of quarterly updates provided by the CIO. The CIO reports to the full Board about cybersecurity on an annual basis.

Our CIO has over 25 years of experience in the Information Technology (“IT”) and cybersecurity industry. The CIO is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. On at least a quarterly basis, the CIO chairs the IT Governance Committee, which includes the executive management team. The purpose of this committee is to inform and make strategic decisions on IT-related matters, including the prevention, detection, mitigation and remediation of cybersecurity incidents. In addition, the CIO regularly reviews key cybersecurity risk metrics and reporting designed to measure the effectiveness of related processes and procedures as part of quarterly updates to the Audit Committee. The CIO utilizes this information in her reporting to the Board and Audit Committee of the Board.

Cybersecurity Risk Management Positions Or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions Or Committees Responsible [Text Block] The Audit Committee regularly monitors the Company’s cybersecurity risks and receives updates from the Chief Information Officer (“CIO”) at each meeting.
Cybersecurity Risk Management Expertise Of Management Responsible [Text Block] Our CIO has over 25 years of experience in the Information Technology (“IT”) and cybersecurity industry.
Cybersecurity Risk Process For Informing Management Or Committees Responsible [Text Block]

Our CIO has over 25 years of experience in the Information Technology (“IT”) and cybersecurity industry. The CIO is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. On at least a quarterly basis, the CIO chairs the IT Governance Committee, which includes the executive management team. The purpose of this committee is to inform and make strategic decisions on IT-related matters, including the prevention, detection, mitigation and remediation of cybersecurity incidents. In addition, the CIO regularly reviews key cybersecurity risk metrics and reporting designed to measure the effectiveness of related processes and procedures as part of quarterly updates to the Audit Committee. The CIO utilizes this information in her reporting to the Board and Audit Committee of the Board.

Cybersecurity Risk Management Positions Or Committees Responsible Report To Board [Flag] true