XML 54 R34.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Risk Management and Strategy
We have established processes for assessing, identifying, and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.
During 2024, we realized our objective of having no material cybersecurity incidents. Furthermore, we have not experienced any material information security breaches and have not incurred material expenses from cybersecurity incidents, including those arising at third parties, during any of the last three years.
By prioritizing cybersecurity at the highest level of our leadership, we assess cybersecurity risk, allocate resources and maintain a culture of cybersecurity awareness throughout Chart. Chart ties cybersecurity or being cyber safe to our key theme of safety, as an industrial manufacturer. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through third-party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other programs: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, encourage proactive vulnerability reporting, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.
We have incident response and breach management processes which occur in stages starting with preparation for cybersecurity incidents followed by detection and analysis of cybersecurity incidents, containment, eradication and recovery, and post-incident analysis. Such incident responses are overseen by leaders from our information security, compliance and legal teams. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.
We also simulate responses to cybersecurity incidents by conducting tabletop exercises. Our cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation, and remediation strategies.
As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. In past years, our Information Security Management System has continued to work a Plan of Action and Milestones (“POAM”) tied to the United States Cybersecurity Maturity Model Certification (“CMMC”) program, formerly the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework, while looking for synergies across other standards, such as the Information Assurance Technical Framework (“IATF”), or as required for specific product lines or customers. Furthermore, we benchmark externally against other industrial manufacturers within the B2B (Business to Business) manufacturing industry, and even to a vertical level to determine Chart’s risk profile through cybersecurity insurance tools that rank companies and bring them together within forums for cyber intelligence sharing and best practices.
Our risk management program also assesses third-party risks to identify and mitigate risks from vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data. In addition, we strive to have the appropriate cybersecurity clauses in our agreements and where necessary we have Data Processing Agreements (“DPAs”) put in place for privacy of data.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
We have established processes for assessing, identifying, and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.
During 2024, we realized our objective of having no material cybersecurity incidents. Furthermore, we have not experienced any material information security breaches and have not incurred material expenses from cybersecurity incidents, including those arising at third parties, during any of the last three years.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Governance
Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. The Board receives updates on a regular basis from senior management, including leaders from our information security, compliance and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity, and data privacy incidents (if any) and status of key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.
Our cybersecurity risk management and strategy processes are overseen by leaders from our information security, compliance and legal teams. The Board of Directors and Chart senior management recognize cybersecurity as a company-wide risk, and the chief information officer/chief information security officer (“CIO/CISO”), as a member of the Chart senior management, works to organize these functional teams given the individual’s experience and background of over 25 years within various IT roles, including the build out of the cybersecurity capability within Chart and at prior companies. Individuals that oversee cybersecurity risk management have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including our incident response plan, and report to the Audit Committee on any appropriate items.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Board receives updates on a regular basis from senior management, including leaders from our information security, compliance and legal teams regarding matters of cybersecurity.
Cybersecurity Risk Role of Management [Text Block]
Our cybersecurity risk management and strategy processes are overseen by leaders from our information security, compliance and legal teams. The Board of Directors and Chart senior management recognize cybersecurity as a company-wide risk, and the chief information officer/chief information security officer (“CIO/CISO”), as a member of the Chart senior management, works to organize these functional teams given the individual’s experience and background of over 25 years within various IT roles, including the build out of the cybersecurity capability within Chart and at prior companies. Individuals that oversee cybersecurity risk management have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including our incident response plan, and report to the Audit Committee on any appropriate items.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] hief information officer/chief information security officer (“CIO/CISO”)
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our cybersecurity risk management and strategy processes are overseen by leaders from our information security, compliance and legal teams. The Board of Directors and Chart senior management recognize cybersecurity as a company-wide risk, and the chief information officer/chief information security officer (“CIO/CISO”), as a member of the Chart senior management, works to organize these functional teams given the individual’s experience and background of over 25 years within various IT roles, including the build out of the cybersecurity capability within Chart and at prior companies. Individuals that oversee cybersecurity risk management have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
Our cybersecurity risk management and strategy processes are overseen by leaders from our information security, compliance and legal teams. The Board of Directors and Chart senior management recognize cybersecurity as a company-wide risk, and the chief information officer/chief information security officer (“CIO/CISO”), as a member of the Chart senior management, works to organize these functional teams given the individual’s experience and background of over 25 years within various IT roles, including the build out of the cybersecurity capability within Chart and at prior companies. Individuals that oversee cybersecurity risk management have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including our incident response plan, and report to the Audit Committee on any appropriate items.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true