XML 24 R12.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management, Strategy and Governance | 12 Months Ended
--- | ---
Dec. 28, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Item 1C. Cybersecurity. The Company has an enterprise-wide cybersecurity program that is informed by the U.S. Department of Commerce National Institute of Standards and Technology Cybersecurity Framework. Our cybersecurity program encompasses the following key capabilities: 24x7 security monitoring, next-generation network security, advanced email and endpoint security, a dedicated enterprise cybersecurity team, third-party managed security services, third-party security assessment services, incident response retainer services, and external risk monitoring services. The Company also maintains cybersecurity risk insurance coverage to defray the costs of potential information security breaches. The Company maintains an incident response plan. Our incident response plan coordinates the actions we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to address potentially applicable legal obligations and mitigate brand and reputational damage. Our incident response plan is updated as appropriate in response to changes within our organization or in response to external factors that may impact us. We test our incident response plan by conducting tabletop exercises on an annual basis. Our associates receive annual cybersecurity training, and we conduct mock phishing campaigns to better enable our associates to recognize phishing emails and other social engineering tactics. We have established reporting processes for our associates if they encounter suspicious activity that may give rise to a cybersecurity incident. Our cybersecurity risk management and strategy processes are led by our Chief Information Officer (“CIO”) and are supported by the Senior Director of Enterprise Cybersecurity. These individuals are also supported by both dedicated cybersecurity professionals and third-party security service providers. Our CIO is responsible for leading our technology organization across our global portfolio, which includes ERP, commercial, supply chain, and product development technologies, enterprise architecture, infrastructure, cyber security, technical operations, end-user services, and finance and human resources systems. Our current interi m CIO has over 30 years of experience in information technology matters. Our Senior Director of Enterprise Cybersecurity has over 30 years of expanding leadership experience in information technology and 18 years of experience in information security leading and developing security programs. Our CIO provides regul ar updates on cybersecurity matters to our senior executives. In the event of a cybersecurity incident or incidents, our incident response plan includes detailed processes designed to ensure that information is triaged from our information technology management team to our CIO and to other members of our management team in a timely manner such that senior leadership can assure critical decision support and oversight and otherwise monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents. Cybersecurity-related risks are assessed as part of the enterprise risk management program. The Audit Committee is responsible for overseeing the Company’s enterprise risk management program. The Audit Committee also oversees the Company's information technology systems and controls, including the cybersecurity program and related risks. Annually, management assesses and ranks the risks identified through the enterprise risk management program according to the likelihood of occurrence and the potential monetary impact, which the Audit Committee reviews. Management also identifies and provides the Audit Committee with quarterly update s on these risks. The CIO typically provides the Audit Committee with cybersecurity updates on a quarterly basis. During such updates, the CIO generally covers topics such as data security positions, results from third-party assessments, our incident response plan, and any material cybersecurity threats and developments. In 2024, the CIO reported to the full Board of Directors on the Company's cybersecurity programs and risk mitigation efforts. As part of the above processes, we engage with assessors, consultants, auditors and other third parties, including by (i) engaging third-party managed security services to assist with the operation of certain aspects of our cybersecurity program, (ii) engaging security assessment services to provide assessments on our cybersecurity program, (iii) engaging an incident response retainer service to provide timely cyber incident response support and digital forensics analysis services, (iv) engaging risk monitoring services to help identify emerging cybersecurity risks, and (v) engaging with other information technology and legal subject matter experts to review our cybersecurity program to help identify areas for continued focus, improvement, and/or compliance. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including risks to our customer, vendor, and employee data and our systems. We conduct due diligence of third parties’ information security programs, and cybersecurity considerations may inform our selection of third-party service providers. In certain circumstances, including in those where we believe a third party could introduce cybersecurity risk to us, we generally seek to contractually require such third parties to manage their cybersecurity risks in certain proscribed manners. We also receive the results of cybersecurity and data privacy audits conducted on certain vendors to determine if those vendors meet our cybersecurity standards. We describe the risks that cybersecurity threats, including as a result of any previous cybersecurity incidents, pose to us that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “We may experience delays or outages in our information technology systems and computer networks and the third-party information technology systems and computer networks that we use. We may be subject to breaches of our information technology systems, the third-party information technology systems that we use or other cybersecurity incidents, which could damage our reputation and consumer relationships. Failures in our information technology systems or in the third-party information technology systems that we use and the costs of increasing information security regulation could also subject us to significant financial, legal and operational consequences" included as part of our risk factor disclosures under Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein. We have experienced, and will continue to experience, cybersecurity incidents in the normal course of our business. However, to our knowledge, we have not had any cybersecurity incidents in the past three years that have had a material adverse effect on our business, financial condition, results of operations, or cash flows.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Cybersecurity-related risks are assessed as part of the enterprise risk management program. The Audit Committee is responsible for overseeing the Company’s enterprise risk management program. The Audit Committee also oversees the Company's information technology systems and controls, including the cybersecurity program and related risks. Annually, management assesses and ranks the risks identified through the enterprise risk management program according to the likelihood of occurrence and the potential monetary impact, which the Audit Committee reviews. Management also identifies and provides the Audit Committee with quarterly update s on these risks.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Audit Committee is responsible for overseeing the Company’s enterprise risk management program. The Audit Committee also oversees the Company's information technology systems and controls, including the cybersecurity program and related risks.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Annually, management assesses and ranks the risks identified through the enterprise risk management program according to the likelihood of occurrence and the potential monetary impact, which the Audit Committee reviews. Management also identifies and provides the Audit Committee with quarterly update s on these risks.
Cybersecurity Risk Role of Management [Text Block] | Our cybersecurity risk management and strategy processes are led by our Chief Information Officer (“CIO”) and are supported by the Senior Director of Enterprise Cybersecurity. These individuals are also supported by both dedicated cybersecurity professionals and third-party security service providers. Our CIO is responsible for leading our technology organization across our global portfolio, which includes ERP, commercial, supply chain, and product development technologies, enterprise architecture, infrastructure, cyber security, technical operations, end-user services, and finance and human resources systems. Our current interi m CIO has over 30 years of experience in information technology matters. Our Senior Director of Enterprise Cybersecurity has over 30 years of expanding leadership experience in information technology and 18 years of experience in information security leading and developing security programs. Our CIO provides regul ar updates on cybersecurity matters to our senior executives. In the event of a cybersecurity incident or incidents, our incident response plan includes detailed processes designed to ensure that information is triaged from our information technology management team to our CIO and to other members of our management team in a timely manner such that senior leadership can assure critical decision support and oversight and otherwise monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Our CIO is responsible for leading our technology organization across our global portfolio, which includes ERP, commercial, supply chain, and product development technologies, enterprise architecture, infrastructure, cyber security, technical operations, end-user services, and finance and human resources systems.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our current interi m CIO has over 30 years of experience in information technology matters. Our Senior Director of Enterprise Cybersecurity has over 30 years of expanding leadership experience in information technology and 18 years of experience in information security leading and developing security programs.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Our incident response plan coordinates the actions we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to address potentially applicable legal obligations and mitigate brand and reputational damage

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration