XML 48 R32.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Risk Management and Strategy

Our cybersecurity risk management process is integrated into our ERM process as described in Item 1A. Risk Factors. Cybersecurity has been identified as a critical risk.

To identify, assess, and manage material cybersecurity risks, we regularly evaluate and take steps to enhance our cybersecurity protocols to protect against or mitigate cyber threats. We conduct third-party and internal assessments of our information technology environments, including system penetration testing, test our recovery and response processes, and we consider industry standards when developing our information security program. The Company has an information security training program, which calls for training all computer-based employees through various employee training modules relative to information security matters and phishing simulation events with employees to raise cybersecurity awareness.

From time to time, we engage third-party assessors, consultants, auditors and others to assist us with evaluating, enhancing, implementing and monitoring our cybersecurity risk-management programs. We maintain processes to oversee and identify cybersecurity risks associated with our use of third-party service providers such as contract and vendor due diligence review, as well as annual review of the service providers’ independent audit report where applicable.

Like many companies, our systems and those of our third party providers who provide us with services and products may be subject to cybersecurity threats and cybersecurity incidents, including those arising from the use of AI

technologies. AI-driven tools, whether deployed internally or by third parties, can introduce new vulnerabilities such as adversarial attacks, data poisoning, or unintended behaviors in automated decision-making systems. To date, no such cybersecurity incidents have had or are reasonably likely to have a material impact on our Company, including its business strategy, results of operations or financial condition. However, if as a result of any future incidents our systems are significantly damaged, cease to function properly or are subject to a significant cybersecurity incident, including those involving AI systems, we may suffer an interruption in our ability to manage and operate the business, and our results of operations and financial condition could be adversely affected. The Company maintains an insurance policy with respect to cybersecurity and has undergone several simulation, preparedness and response exercises. See “Risks Related to Manufacturing and Operations” in Item 1A. Risk Factors.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]

From time to time, we engage third-party assessors, consultants, auditors and others to assist us with evaluating, enhancing, implementing and monitoring our cybersecurity risk-management programs. We maintain processes to oversee and identify cybersecurity risks associated with our use of third-party service providers such as contract and vendor due diligence review, as well as annual review of the service providers’ independent audit report where applicable.

Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

Governance

The Board oversees the management of our risks, including risks from cybersecurity threats, on an enterprise-wide basis, and the Lead Independent Director promotes our Board’s engagement in this process. The Board has delegated oversight of the risk assessment and mitigation process with respect to cybersecurity to the Audit Committee of the Board. The Audit Committee regularly monitors the Company’s cybersecurity risks and receives updates from the Chief Digital Information Officer (“CDIO”) at each meeting. In addition, the Audit Committee regularly reviews the overall effectiveness of the information technology security environment as part of quarterly updates provided by the CDIO. The CDIO reports to the full Board about cybersecurity on an annual basis.

Our CDIO has over 25 years of experience in the Information Technology (“IT”) and cybersecurity industry. The CDIO is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. On at least a quarterly basis, the CDIO chairs a meeting of the IT Governance Committee, which includes the executive management team. The purpose of this committee is to inform and make strategic decisions on IT-related matters, including the prevention, detection, mitigation and remediation of cybersecurity incidents. In addition, the CDIO regularly reviews key cybersecurity risk metrics and reporting designed to measure the effectiveness of related processes and procedures as part of quarterly updates to the Audit Committee. The CDIO utilizes this information in her reporting to the Board and Audit Committee of the Board.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Audit Committee of the Board
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]

The Board oversees the management of our risks, including risks from cybersecurity threats, on an enterprise-wide basis, and the Lead Independent Director promotes our Board’s engagement in this process. The Board has delegated oversight of the risk assessment and mitigation process with respect to cybersecurity to the Audit Committee of the Board. The Audit Committee regularly monitors the Company’s cybersecurity risks and receives updates from the Chief Digital Information Officer (“CDIO”) at each meeting. In addition, the Audit Committee regularly reviews the overall effectiveness of the information technology security environment as part of quarterly updates provided by the CDIO. The CDIO reports to the full Board about cybersecurity on an annual basis.

Our CDIO has over 25 years of experience in the Information Technology (“IT”) and cybersecurity industry. The CDIO is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. On at least a quarterly basis, the CDIO chairs a meeting of the IT Governance Committee, which includes the executive management team. The purpose of this committee is to inform and make strategic decisions on IT-related matters, including the prevention, detection, mitigation and remediation of cybersecurity incidents. In addition, the CDIO regularly reviews key cybersecurity risk metrics and reporting designed to measure the effectiveness of related processes and procedures as part of quarterly updates to the Audit Committee. The CDIO utilizes this information in her reporting to the Board and Audit Committee of the Board.

Cybersecurity Risk Role of Management [Text Block]

The Board oversees the management of our risks, including risks from cybersecurity threats, on an enterprise-wide basis, and the Lead Independent Director promotes our Board’s engagement in this process. The Board has delegated oversight of the risk assessment and mitigation process with respect to cybersecurity to the Audit Committee of the Board. The Audit Committee regularly monitors the Company’s cybersecurity risks and receives updates from the Chief Digital Information Officer (“CDIO”) at each meeting. In addition, the Audit Committee regularly reviews the overall effectiveness of the information technology security environment as part of quarterly updates provided by the CDIO. The CDIO reports to the full Board about cybersecurity on an annual basis.

Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Audit Committee regularly monitors the Company’s cybersecurity risks and receives updates from the Chief Digital Information Officer (“CDIO”) at each meeting.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]

Our CDIO has over 25 years of experience in the Information Technology (“IT”) and cybersecurity industry. The CDIO is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. On at least a quarterly basis, the CDIO chairs a meeting of the IT Governance Committee, which includes the executive management team. The purpose of this committee is to inform and make strategic decisions on IT-related matters, including the prevention, detection, mitigation and remediation of cybersecurity incidents. In addition, the CDIO regularly reviews key cybersecurity risk metrics and reporting designed to measure the effectiveness of related processes and procedures as part of quarterly updates to the Audit Committee. The CDIO utilizes this information in her reporting to the Board and Audit Committee of the Board.

Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]

Our CDIO has over 25 years of experience in the Information Technology (“IT”) and cybersecurity industry. The CDIO is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. On at least a quarterly basis, the CDIO chairs a meeting of the IT Governance Committee, which includes the executive management team. The purpose of this committee is to inform and make strategic decisions on IT-related matters, including the prevention, detection, mitigation and remediation of cybersecurity incidents. In addition, the CDIO regularly reviews key cybersecurity risk metrics and reporting designed to measure the effectiveness of related processes and procedures as part of quarterly updates to the Audit Committee. The CDIO utilizes this information in her reporting to the Board and Audit Committee of the Board.

Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true