XML 49 R33.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 29, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | The Company and its Board recognize the critical significance that cybersecurity has to our operations and the need to continually assess cybersecurity risk and evolve our response in the face of a rapidly and ever-changing environment. We face a range of increasing and evolving cybersecurity threats common to industrial operations and other enterprises, which continue to grow in frequency and scope. See Item 1A, Risk Factors, “Cybersecurity Threats.” The programs and procedures we have implemented to mitigate our exposure to these threats focus on preventing cybersecurity incidents, preserving the confidentiality, security and availability of the information that we generate or collect and store, and effectively responding to cybersecurity incidents if they occur. Our Comprehensive Program We take a comprehensive, standards-driven approach to our cybersecurity through an enterprise-wide cybersecurity program aligned with the National Institute on Standards and Technology’s Cybersecurity Framework. Our program includes an extensive set of systems, network and application-level controls that protect our corporate data and systems. Our Chief Digital and Information Officer (“CDIO”) and our Chief Information Security Officer (“CISO”), each of whom have extensive cybersecurity training and expertise and more than 20 years and 14 years of information technology and cybersecurity experience, respectively, hold primary responsibility within management for assessing, monitoring and managing our cybersecurity risks and program. They are supported by a dedicated, enterprise-wide cybersecurity team that, with the assistance of third-party providers, monitors our program and controls, as well as available cybersecurity intelligence, on a continuous basis to ensure that, as an organization, we are informed of emerging risks, identify specific threats and potential incidents, and promptly escalate the evaluation and management of identified incidents as appropriate. Components of our comprehensive program include, among others: •Technical Safeguards. We deploy technical safeguards that are designed to protect the Company’s information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated through vulnerability assessments and cybersecurity threat intelligence. •Third-Party Risk Management. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties. •Program Assessments. We engage in regular assessments and testing of our policies and procedures, including efforts such as audits and similar assessments, tabletop exercises, threat modeling, vulnerability testing and other procedures focused on evaluating program effectiveness. Additionally, we periodically engage third parties to perform assessments of our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. •Education and Awareness. We conduct a regular program of enterprise-wide communication and training regarding cybersecurity threats and the policies and procedures we have implemented in response. These programs are designed to elevate threat awareness within the Company and equip our employees with the knowledge and access to resources that they need to appropriately respond to and address the cybersecurity risks that we face. •Incident Response and Recovery. We maintain extensive incident response and recovery plans and procedures that provide a documented framework for handling high severity security incidents. These plans ensure the appropriate escalation, evaluation, management and reporting of cybersecurity incidents in a prompt and appropriately cross- functional manner, facilitating coordination across multiple parts of the Company, and are the subject of regular table- top breach simulations and other exercises and evaluations. •Insurance Coverage. We maintain a cybersecurity risk insurance policy to protect the Company against computer-related incidents and losses. We have not experienced any operational or financial impact as a result of any cybersecurity incident or the cybersecurity risk that we face, and at this time, while the threat of a cybersecurity incident is always present, we view our comprehensive mitigation strategies and procedures as appropriately calibrated safeguards against any material impact to our results of operation and financial condition as a result of a cybersecurity incident and believe that we are prepared to appropriately mitigate and respond to such an incident, should it occur.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | The regular review and assessment of the Company’s cybersecurity program and related policies, standards, processes and practices is a fully integrated component of the Company’s overall enterprise risk management program, and at least quarterly as a key component of each regularly scheduled meeting, the Committee receives regular reports from our CDIO on the Company’s cybersecurity risk profile, the functioning of its cybersecurity program, including with reference to key performance indicators and other specific, quantitative measures, and other digital technology risks.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Our Board is actively engaged in the oversight of our digital technology risk management and cybersecurity programs. As part of its program of regular oversight, the Audit and Risk Committee oversees ATI’s digital technology and cybersecurity risk.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our program includes an extensive set of systems, network and application-level controls that protect our corporate data and systems. Our Chief Digital and Information Officer (“CDIO”) and our Chief Information Security Officer (“CISO”), each of whom have extensive cybersecurity training and expertise and more than 20 years and 14 years of information technology and cybersecurity experience, respectively, hold primary responsibility within management for assessing, monitoring and managing our cybersecurity risks and program.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our Board is actively engaged in the oversight of our digital technology risk management and cybersecurity programs. As part of its program of regular oversight, the Audit and Risk Committee oversees ATI’s digital technology and cybersecurity risk. The regular review and assessment of the Company’s cybersecurity program and related policies, standards, processes and practices is a fully integrated component of the Company’s overall enterprise risk management program, and at least quarterly as a key component of each regularly scheduled meeting, the Committee receives regular reports from our CDIO on the Company’s cybersecurity risk profile, the functioning of its cybersecurity program, including with reference to key performance indicators and other specific, quantitative measures, and other digital technology risks.
Cybersecurity Risk Role of Management [Text Block] | Our Comprehensive Program We take a comprehensive, standards-driven approach to our cybersecurity through an enterprise-wide cybersecurity program aligned with the National Institute on Standards and Technology’s Cybersecurity Framework. Our program includes an extensive set of systems, network and application-level controls that protect our corporate data and systems. Our Chief Digital and Information Officer (“CDIO”) and our Chief Information Security Officer (“CISO”), each of whom have extensive cybersecurity training and expertise and more than 20 years and 14 years of information technology and cybersecurity experience, respectively, hold primary responsibility within management for assessing, monitoring and managing our cybersecurity risks and program. They are supported by a dedicated, enterprise-wide cybersecurity team that, with the assistance of third-party providers, monitors our program and controls, as well as available cybersecurity intelligence, on a continuous basis to ensure that, as an organization, we are informed of emerging risks, identify specific threats and potential incidents, and promptly escalate the evaluation and management of identified incidents as appropriate. Components of our comprehensive program include, among others: •Technical Safeguards. We deploy technical safeguards that are designed to protect the Company’s information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated through vulnerability assessments and cybersecurity threat intelligence. •Third-Party Risk Management. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties. •Program Assessments. We engage in regular assessments and testing of our policies and procedures, including efforts such as audits and similar assessments, tabletop exercises, threat modeling, vulnerability testing and other procedures focused on evaluating program effectiveness. Additionally, we periodically engage third parties to perform assessments of our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. •Education and Awareness. We conduct a regular program of enterprise-wide communication and training regarding cybersecurity threats and the policies and procedures we have implemented in response. These programs are designed to elevate threat awareness within the Company and equip our employees with the knowledge and access to resources that they need to appropriately respond to and address the cybersecurity risks that we face. •Incident Response and Recovery. We maintain extensive incident response and recovery plans and procedures that provide a documented framework for handling high severity security incidents. These plans ensure the appropriate escalation, evaluation, management and reporting of cybersecurity incidents in a prompt and appropriately cross- functional manner, facilitating coordination across multiple parts of the Company, and are the subject of regular table- top breach simulations and other exercises and evaluations. •Insurance Coverage. We maintain a cybersecurity risk insurance policy to protect the Company against computer-related incidents and losses.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | We take a comprehensive, standards-driven approach to our cybersecurity through an enterprise-wide cybersecurity program aligned with the National Institute on Standards and Technology’s Cybersecurity Framework. Our program includes an extensive set of systems, network and application-level controls that protect our corporate data and systems. Our Chief Digital and Information Officer (“CDIO”) and our Chief Information Security Officer (“CISO”), each of whom have extensive cybersecurity training and expertise and more than 20 years and 14 years of information technology and cybersecurity experience, respectively, hold primary responsibility within management for assessing, monitoring and managing our cybersecurity risks and program.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | each of whom have extensive cybersecurity training and expertise and more than 20 years and 14 years of information technology and cybersecurity experience, respectively, hold primary responsibility within management for assessing, monitoring and managing our cybersecurity risks and program.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Our Board is actively engaged in the oversight of our digital technology risk management and cybersecurity programs. As part of its program of regular oversight, the Audit and Risk Committee oversees ATI’s digital technology and cybersecurity risk. The regular review and assessment of the Company’s cybersecurity program and related policies, standards, processes and practices is a fully integrated component of the Company’s overall enterprise risk management program, and at least quarterly as a key component of each regularly scheduled meeting, the Committee receives regular reports from our CDIO on the Company’s cybersecurity risk profile, the functioning of its cybersecurity program, including with reference to key performance indicators and other specific, quantitative measures, and other digital technology risks.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration