XML 48 R31.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 28, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Cybersecurity Risk Management and Strategy
Charles River places high importance on identifying and mitigating potential cybersecurity threats to its employees, customers, IT infrastructure, proprietary technologies and confidential information.
Our cybersecurity risk management is based on recognized industry governance frameworks, including the International Organization for Standardization (ISO), the National Institute of Standards and Technology (NIST), the Center for Internet Security Controls (CIS), and the Cloud Security Alliance (CSA). We use these frameworks together with information collected from internal and 3rd party assessments to develop policies such as our technology acceptable use policy for information assets, our access requirements for data, systems, or technologies, and policies for the protection and use of personal information of our employees and customers. We protect our IT assets through industry-standard techniques such as multifactor authentication, malware defenses, network and endpoint monitoring, and access review processes. We also work with our business units to leverage and implement foundational cybersecurity principles, such as security by design, defense-in-depth, least privilege, and resilience-focused backups, throughout our organization. We deliver cybersecurity awareness and confidential information protection training to our employees, and we send our employees ethical simulated phishing and spear-phishing emails to test their compliance with our policies.
We engage third parties to conduct annual penetration testing, and we use external risk assessors to measure our program to industry standard frameworks. Our information security management system is certified to the ISO/IEC 27001:2013 and 27017:2018 standards by the British Standards Institution (BSI); certificates IS 780367 and CLOUD 806141,respectively. We also collaborate with experts and industry partners to exchange information about threats, best practices, and trends.
Our cybersecurity risk management extends to risks associated with our use of third-party service and technology providers as well as partnerships with third parties we may enter into. For instance, we conduct risk and compliance assessments of third parties that request access to our IT resources and information or who provide technology products or services to Charles River.
Our cybersecurity risk management is an important part of our comprehensive business continuity program and enterprise risk management. Our global information security team periodically engages with a cross-functional group of Charles River subject-matter experts and leaders to assess and refine Charles River’s cybersecurity risk posture and preparedness. For example, we regularly evaluate and update contingency strategies for our business in the event that a portion of our IT systems were to be unavailable due to a cybersecurity incident. We practice our response to potential cybersecurity incidents through regular tabletop exercises. We also perform threat hunting and red team exercises.
Through these processes, during our fiscal year 2024 and through the date of this filing we did not identify risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an
undetected cybersecurity incident. For more information about these risks, please see the section titled “Item 1A. Risk Factors – Business and Operational Risk Factors - We have in the past experienced and in the future could experience unauthorized access into our information systems.”
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
Charles River places high importance on identifying and mitigating potential cybersecurity threats to its employees, customers, IT infrastructure, proprietary technologies and confidential information.
Our cybersecurity risk management is based on recognized industry governance frameworks, including the International Organization for Standardization (ISO), the National Institute of Standards and Technology (NIST), the Center for Internet Security Controls (CIS), and the Cloud Security Alliance (CSA). We use these frameworks together with information collected from internal and 3rd party assessments to develop policies such as our technology acceptable use policy for information assets, our access requirements for data, systems, or technologies, and policies for the protection and use of personal information of our employees and customers. We protect our IT assets through industry-standard techniques such as multifactor authentication, malware defenses, network and endpoint monitoring, and access review processes. We also work with our business units to leverage and implement foundational cybersecurity principles, such as security by design, defense-in-depth, least privilege, and resilience-focused backups, throughout our organization. We deliver cybersecurity awareness and confidential information protection training to our employees, and we send our employees ethical simulated phishing and spear-phishing emails to test their compliance with our policies.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Our board of directors, as a whole, has oversight responsibility for Charles River’s strategic and operational risks. The Audit Committee of the Board of Directors has been delegated by the Board responsibility by reviewing and discussing Charles River’s risk assessment and risk management practices, including cybersecurity risks, with members of management. The Audit Committee, in turn, periodically discusses its review and assessment with the board of directors.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee of the Board of Directors has been delegated by the Board responsibility by reviewing and discussing Charles River’s risk assessment and risk management practices, including cybersecurity risks, with members of management. The Audit Committee, in turn, periodically discusses its review and assessment with the board of directors.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
Our Chief Information Officer and our Chief Information Security Officer meet regularly with the full Board, and periodically, but generally at least quarterly, with the Chief Executive Officer, Chief Operations Officer, and Audit Committee to review the company’s information technology systems and discuss key cybersecurity risks. Our Chief Information Security Officer has direct access to the Chair of our Audit Committee and keeps the Audit Committee apprised of any developments that may emerge in between regularly scheduled meetings that require its attention. Additionally, our Incident Response Plan includes escalation protocols to raise occurrences that require attention from the Audit Committee or the board of directors as a whole.
Cybersecurity Risk Role of Management [Text Block]
Our management team is responsible for day-to-day assessment and management of cybersecurity risks. On our management team, our Chief Information Officer has primary oversight of material risks from cybersecurity threats. The Chief Information Officer is Charles River’s Senior Vice President responsible for the Global Technology organization and for information protection at Charles River. The Chief Information Officer has more than 25 years of experience in the field, including serving as the Senior Vice President of Charles River’s Digital Transformation organization, leading the development and implementation of information technology strategies and roadmaps for digital and automation solutions.
Our Chief Information Security Officer reports to our Chief Information Officer. Our Chief Information Security Officer has more than 25 years of experience working in information technology-related roles, of which more than 10 years has been in information security leadership, and holds degrees in bio-medical engineering and computer science.
Our Chief Information Officer and Chief Information Security Officer assess our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits, and evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to our Chief Information Officer and Chief Information Security Officer, such as potential threats or vulnerabilities. We also employ various defensive and monitoring techniques based on industry frameworks and cybersecurity standards.
Our Chief Information Officer and our Chief Information Security Officer meet regularly with the full Board, and periodically, but generally at least quarterly, with the Chief Executive Officer, Chief Operations Officer, and Audit Committee to review the company’s information technology systems and discuss key cybersecurity risks. Our Chief Information Security Officer has direct access to the Chair of our Audit Committee and keeps the Audit Committee apprised of any developments that may emerge in between regularly scheduled meetings that require its attention. Additionally, our Incident Response Plan includes escalation protocols to raise occurrences that require attention from the Audit Committee or the board of directors as a whole.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our management team is responsible for day-to-day assessment and management of cybersecurity risks. On our management team, our Chief Information Officer has primary oversight of material risks from cybersecurity threats. The Chief Information Officer is Charles River’s Senior Vice President responsible for the Global Technology organization and for information protection at Charles River.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Chief Information Officer has more than 25 years of experience in the field, including serving as the Senior Vice President of Charles River’s Digital Transformation organization, leading the development and implementation of information technology strategies and roadmaps for digital and automation solutions.
Our Chief Information Security Officer reports to our Chief Information Officer. Our Chief Information Security Officer has more than 25 years of experience working in information technology-related roles, of which more than 10 years has been in information security leadership, and holds degrees in bio-medical engineering and computer science.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
Our Chief Information Officer and our Chief Information Security Officer meet regularly with the full Board, and periodically, but generally at least quarterly, with the Chief Executive Officer, Chief Operations Officer, and Audit Committee to review the company’s information technology systems and discuss key cybersecurity risks. Our Chief Information Security Officer has direct access to the Chair of our Audit Committee and keeps the Audit Committee apprised of any developments that may emerge in between regularly scheduled meetings that require its attention. Additionally, our Incident Response Plan includes escalation protocols to raise occurrences that require attention from the Audit Committee or the board of directors as a whole.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true