XML 44 R27.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | The IRP provides our management and information technology personnel with processes and procedures for assessing, identifying, managing and escalating material risks from cybersecurity threats which have been integrated into our overall risk management processes. For example, our enterprise risk management processes involve the identification of events that may arise in the course of operating our business and the potential impact of such events on our business. We have identified and prioritized cybersecurity events as requiring increased managerial focus and urgency in actions taken to mitigate cybersecurity risks due to the potential impact such events could have on our business. Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations or financial condition, it is possible that a cybersecurity incident resulting in a serious compromise of our IT Systems or a demand for payment to restore our IT Systems, could have a material adverse effect on us by negatively impacting our ability to operate our business effectively and by diverting the attention of our management and other resources, including financial resources, to address the cybersecurity incident. Despite our efforts to mitigate the risks associated with cybersecurity threats, we cannot eliminate all such risks or provide assurance that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, “Risk Factors” in this Annual Report on Form 10-K. In connection with our processes for assessing, identifying and managing risk from cybersecurity, we engage various third parties to assist in managing these processes including: •Outside cybersecurity legal counsel to assist in updating our IRP and for consultation and coordination with other third parties in the event of a cyber incident; •Cybersecurity vendors that would perform various investigation services in the event of a cyber incident including assisting in determining the type of attack and impact to our information technology network, maintaining cybersecurity vigilance and assisting with the recovery and restoration of any impacted IT System services; •Cybersecurity experts who would, in the event of a cybersecurity incident, assist with validation of the incident; and •Vendors that would provide breach response services such as communications, notification to third parties and credit monitoring. In addition to our IRP, we have also implemented processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. For example, where appropriate, we seek to negotiate contractual terms with certain third-party service providers that impose obligations on such service providers with the goal of protecting our confidential information.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | The IRP provides our management and information technology personnel with processes and procedures for assessing, identifying, managing and escalating material risks from cybersecurity threats which have been integrated into our overall risk management processes. For example, our enterprise risk management processes involve the identification of events that may arise in the course of operating our business and the potential impact of such events on our business. We have identified and prioritized cybersecurity events as requiring increased managerial focus and urgency in actions taken to mitigate cybersecurity risks due to the potential impact such events could have on our business. Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations or financial condition, it is possible that a cybersecurity incident resulting in a serious compromise of our IT Systems or a demand for payment to restore our IT Systems, could have a material adverse effect on us by negatively impacting our ability to operate our business effectively and by diverting the attention of our management and other resources, including financial resources, to address the cybersecurity incident. Despite our efforts to mitigate the risks associated with cybersecurity threats, we cannot eliminate all such risks or provide assurance that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, “Risk Factors” in this Annual Report on Form 10-K.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Our Incident Response Team has the primary responsibility of assessing and managing risks from cybersecurity threats and implementing the various stages of our IRP set forth above. The Incident Response Team is comprised of the following IT Systems management personnel and members of senior management: •Chief Information Officer (“CIO”) – Our CIO has over 25 years of information technology experience across a wide range of industry sectors including life sciences, medical device, pharmaceutical, real estate and software development with responsibility in cybersecurity, data analytics and GenAI implementations for the last 10 years, and 20 years of business continuity planning and disaster recovery planning and execution. Our CIO has oversight of our cybersecurity strategy and building out our cybersecurity capabilities and infrastructure in response to the growing threat from potential cyber security incidents on our IT Systems. Our CIO is also responsible for the integration of our cybersecurity management into our overall enterprise risk management strategy; •Associate Director, Information Technology (“IT Security Director”) – Our IT Security Director has approximately 20 years of relevant information technology experience including at least 15 years of hands-on experience working in various cybersecurity domains, including asset and network security and architecture, identity access management, disaster recovery and business continuity. Our IT Security Director’s responsibilities include serving as the lead for cybersecurity under the direction of the CIO and maturing our cybersecurity program across all cybersecurity domains, including security and risk management. Our IT Security Director is a Certified Information Systems Security Professional and has an NACD CERT certificate in cybersecurity oversight; •Senior Vice President, Chief Legal Officer – Our Chief Legal Officer oversees our enterprise risk management strategy and serves as the executive management representative on our Incident Response Team; and •Vice President, Business Continuity & Sustainable Operations (“VP Business Continuity”) – Our VP Business Continuity has responsibility for overseeing our Business Continuity Plan which incorporates our IRP. Our VP Business Continuity has over 15 years leading the business continuity programs for various companies and has training on ISO 22301 (the Business Continuity ISO Standard). Under its committee charter, the Audit Committee of the Board of Directors (the “Audit Committee”) is responsible for discussing with senior management our policies with respect to risk assessment and risk management and for discussing with management our financial risk exposures and the steps management has taken to monitor and control such exposures. In particular, the Audit Committee oversees our cybersecurity strategy designed to identify, assess and mitigate cybersecurity risks, and reviews our cybersecurity and other information technology risks, controls and procedures, and receives periodic updates from management on cybersecurity regarding the adequacy and effectiveness of our cybersecurity measures. In fulfilling this oversight responsibility, the Audit Committee receives a periodic update of our cybersecurity strategy. Included in this review is a thorough discussion of the risks from cybersecurity threats including the potential impact of such threats to our operations. Specifically, with respect to cybersecurity risks, Incident Response Team members report to the Audit Committee on the (i) potential impact of the risk to the business, (ii) our current capabilities in managing such risks, (iii) the urgency for action in managing such risks and (iv) the outlook for a potential impact on us as a result of the risk. The Audit Committee also receives reports from members of the Incident Response Team on our mitigation efforts to address cybersecurity risks. We have also instituted a separate process for communicating with the Audit Committee regarding any risks from an actual cybersecurity threat in the event we are the target of a specific cybersecurity incident. As part of our response to such an incident, members of the Incident Response Team would provide an initial awareness communication of the incident to our Chief Financial Officer then to the Chief Executive Officer who would in turn inform the Chairman of our Board of Directors (“Board Chair”) and the Chair of the Audit Committee (“Audit Committee Chair”). Following an initial assessment of the incident by senior management and IT Systems personnel, we would provide a follow-up communication to the Board Chair and Audit Committee Chair and determine whether further escalation to the full Board of Directors is warranted.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Under its committee charter, the Audit Committee of the Board of Directors (the “Audit Committee”) is responsible for discussing with senior management our policies with respect to risk assessment and risk management and for discussing with management our financial risk exposures and the steps management has taken to monitor and control such exposures. In particular, the Audit Committee oversees our cybersecurity strategy designed to identify, assess and mitigate cybersecurity risks, and reviews our cybersecurity and other information technology risks, controls and procedures, and receives periodic updates from management on cybersecurity regarding the adequacy and effectiveness of our cybersecurity measures. In fulfilling this oversight responsibility, the Audit Committee receives a periodic update of our cybersecurity strategy. Included in this review is a thorough discussion of the risks from cybersecurity threats including the potential impact of such threats to our operations. Specifically, with respect to cybersecurity risks, Incident Response Team members report to the Audit Committee on the (i) potential impact of the risk to the business, (ii) our current capabilities in managing such risks, (iii) the urgency for action in managing such risks and (iv) the outlook for a potential impact on us as a result of the risk. The Audit Committee also receives reports from members of the Incident Response Team on our mitigation efforts to address cybersecurity risks.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | In fulfilling this oversight responsibility, the Audit Committee receives a periodic update of our cybersecurity strategy. Included in this review is a thorough discussion of the risks from cybersecurity threats including the potential impact of such threats to our operations. Specifically, with respect to cybersecurity risks, Incident Response Team members report to the Audit Committee on the (i) potential impact of the risk to the business, (ii) our current capabilities in managing such risks, (iii) the urgency for action in managing such risks and (iv) the outlook for a potential impact on us as a result of the risk. The Audit Committee also receives reports from members of the Incident Response Team on our mitigation efforts to address cybersecurity risks.
Cybersecurity Risk Role of Management [Text Block] | Chief Information Officer (“CIO”) – Our CIO has over 25 years of information technology experience across a wide range of industry sectors including life sciences, medical device, pharmaceutical, real estate and software development with responsibility in cybersecurity, data analytics and GenAI implementations for the last 10 years, and 20 years of business continuity planning and disaster recovery planning and execution. Our CIO has oversight of our cybersecurity strategy and building out our cybersecurity capabilities and infrastructure in response to the growing threat from potential cyber security incidents on our IT Systems. Our CIO is also responsible for the integration of our cybersecurity management into our overall enterprise risk management strategy; •Associate Director, Information Technology (“IT Security Director”) – Our IT Security Director has approximately 20 years of relevant information technology experience including at least 15 years of hands-on experience working in various cybersecurity domains, including asset and network security and architecture, identity access management, disaster recovery and business continuity. Our IT Security Director’s responsibilities include serving as the lead for cybersecurity under the direction of the CIO and maturing our cybersecurity program across all cybersecurity domains, including security and risk management. Our IT Security Director is a Certified Information Systems Security Professional and has an NACD CERT certificate in cybersecurity oversight; •Senior Vice President, Chief Legal Officer – Our Chief Legal Officer oversees our enterprise risk management strategy and serves as the executive management representative on our Incident Response Team; and •Vice President, Business Continuity & Sustainable Operations (“VP Business Continuity”) – Our VP Business Continuity has responsibility for overseeing our Business Continuity Plan which incorporates our IRP. Our VP Business Continuity has over 15 years leading the business continuity programs for various companies and has training on ISO 22301 (the Business Continuity ISO Standard).
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Under its committee charter, the Audit Committee of the Board of Directors (the “Audit Committee”) is responsible for discussing with senior management our policies with respect to risk assessment and risk management and for discussing with management our financial risk exposures and the steps management has taken to monitor and control such exposures. In particular, the Audit Committee oversees our cybersecurity strategy designed to identify, assess and mitigate cybersecurity risks, and reviews our cybersecurity and other information technology risks, controls and procedures, and receives periodic updates from management on cybersecurity regarding the adequacy and effectiveness of our cybersecurity measures. In fulfilling this oversight responsibility, the Audit Committee receives a periodic update of our cybersecurity strategy. Included in this review is a thorough discussion of the risks from cybersecurity threats including the potential impact of such threats to our operations. Specifically, with respect to cybersecurity risks, Incident Response Team members report to the Audit Committee on the (i) potential impact of the risk to the business, (ii) our current capabilities in managing such risks, (iii) the urgency for action in managing such risks and (iv) the outlook for a potential impact on us as a result of the risk. The Audit Committee also receives reports from members of the Incident Response Team on our mitigation efforts to address cybersecurity risks.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Chief Information Officer (“CIO”) – Our CIO has over 25 years of information technology experience across a wide range of industry sectors including life sciences, medical device, pharmaceutical, real estate and software development with responsibility in cybersecurity, data analytics and GenAI implementations for the last 10 years, and 20 years of business continuity planning and disaster recovery planning and execution. Our CIO has oversight of our cybersecurity strategy and building out our cybersecurity capabilities and infrastructure in response to the growing threat from potential cyber security incidents on our IT Systems. Our CIO is also responsible for the integration of our cybersecurity management into our overall enterprise risk management strategy; •Associate Director, Information Technology (“IT Security Director”) – Our IT Security Director has approximately 20 years of relevant information technology experience including at least 15 years of hands-on experience working in various cybersecurity domains, including asset and network security and architecture, identity access management, disaster recovery and business continuity. Our IT Security Director’s responsibilities include serving as the lead for cybersecurity under the direction of the CIO and maturing our cybersecurity program across all cybersecurity domains, including security and risk management. Our IT Security Director is a Certified Information Systems Security Professional and has an NACD CERT certificate in cybersecurity oversight; •Senior Vice President, Chief Legal Officer – Our Chief Legal Officer oversees our enterprise risk management strategy and serves as the executive management representative on our Incident Response Team; and •Vice President, Business Continuity & Sustainable Operations (“VP Business Continuity”) – Our VP Business Continuity has responsibility for overseeing our Business Continuity Plan which incorporates our IRP. Our VP Business Continuity has over 15 years leading the business continuity programs for various companies and has training on ISO 22301 (the Business Continuity ISO Standard).
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | We have also instituted a separate process for communicating with the Audit Committee regarding any risks from an actual cybersecurity threat in the event we are the target of a specific cybersecurity incident. As part of our response to such an incident, members of the Incident Response Team would provide an initial awareness communication of the incident to our Chief Financial Officer then to the Chief Executive Officer who would in turn inform the Chairman of our Board of Directors (“Board Chair”) and the Chair of the Audit Committee (“Audit Committee Chair”). Following an initial assessment of the incident by senior management and IT Systems personnel, we would provide a follow-up communication to the Board Chair and Audit Committee Chair and determine whether further escalation to the full Board of Directors is warranted.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration