XML 161 R29.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

As is the case for most companies, we are regularly subject to cyber-attacks and other cyber incidents and, therefore, cybersecurity is an important element of our overall enterprise risk management program. As part of our ordinary course of business, we collect, store and transmit large amounts of confidential information, including personal information, operational and financial transactions and records, clinical trial data and information relating to intellectual property, on internal information systems and through the information systems of collaborators and third-party vendors with whom we contract. We have a multilayered approach for assessing, identifying and managing cybersecurity risks, that is designed to help protect such information from internal and external cyber threats by understanding and seeking to mitigate risk while ensuring business resiliency. Our cybersecurity prevention methods include implementing the National Institute of Standards and Technology cybersecurity framework, instituting a training and compliance program on cybersecurity for all employees, completing a yearly external audit and penetration test, conducting vulnerability scans and remediations and monitoring threat intelligence feeds. As part of our overall risk management strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches. We also conduct security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This process involves third-party providers responding to cybersecurity questionnaires and information technology, or IT, security team meetings to review and assess the third-party providers security posture to confirm that the provider is ensuring the security, integrity, and availability of processed data.

We have also established a global incident response management standard operating procedure, or GIRM. Our GIRM provides step-by-step instructions for managing any global incident which is disruptive of or interferes with the delivery and operation of our IT services and systems that are in use. Specifically, our GIRM provides direction as to how information with respect to a cybersecurity incident is communicated internally, including with our executive committee leadership team. As regulatory disclosure requirements regarding cybersecurity incidents and data privacy matters have

become more prevalent, we have developed an incident workflow designed to monitor and evaluate if such disclosure requirements are triggered by an incident through the inclusion of members of our legal, data privacy and executive teams in the incident response process.

We engage third parties, including independent privacy assessors, computer security firms and risk management and governance experts to enhance our cybersecurity oversight. For example, on an annual basis we run a penetration test of our systems, performed by a different external third party each year. We also regularly consult with these third parties on emerging industry trends.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] We have a multilayered approach for assessing, identifying and managing cybersecurity risks, that is designed to help protect such information from internal and external cyber threats by understanding and seeking to mitigate risk while ensuring business resiliency. Our cybersecurity prevention methods include implementing the National Institute of Standards and Technology cybersecurity framework, instituting a training and compliance program on cybersecurity for all employees, completing a yearly external audit and penetration test, conducting vulnerability scans and remediations and monitoring threat intelligence feeds. As part of our overall risk management strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches. We also conduct security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This process involves third-party providers responding to cybersecurity questionnaires and information technology, or IT, security team meetings to review and assess the third-party providers security posture to confirm that the provider is ensuring the security, integrity, and availability of processed data.

We have also established a global incident response management standard operating procedure, or GIRM. Our GIRM provides step-by-step instructions for managing any global incident which is disruptive of or interferes with the delivery and operation of our IT services and systems that are in use. Specifically, our GIRM provides direction as to how information with respect to a cybersecurity incident is communicated internally, including with our executive committee leadership team. As regulatory disclosure requirements regarding cybersecurity incidents and data privacy matters have

become more prevalent, we have developed an incident workflow designed to monitor and evaluate if such disclosure requirements are triggered by an incident through the inclusion of members of our legal, data privacy and executive teams in the incident response process.

Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

Our Board of Directors administers its cybersecurity risk oversight function primarily through the Audit Committee of the Board of Directors. In accordance with our Audit Committee Charter, our Chief Information Officer, or CIO, provides periodic updates to our Audit Committee regarding the Company’s cybersecurity and other technology risks, internal controls and procedures, including the Company’s plan to mitigate cybersecurity risk and respond to data breaches. The Audit Committee is also responsible for reviewing any related periodic public filing disclosures. The Board of Directors receives regular reports from the Audit Committee. Our CIO also presents directly to our Board of Directors on an annual basis on these matters. Our IT team is responsible for maintaining daily operations and ensuring the confidentiality, integrity and availability of data. Our CIO oversees a cybersecurity team that has over 15 years’ experience in cybersecurity along with advanced and undergrad degrees in cybersecurity, and industry recognized security certifications such as CISSP (Certified Information Systems Security Professional) and CISM (Certified Information Security Manager). Our CIO reports directly to our Chief Legal Officer, both of whom are members of our executive committee leadership team. Cybersecurity incident status updates are provided as necessary to the executive committee as set forth in our GIRM. In the event of a cybersecurity incident, our IT team is trained to follow our GIRM.

In an effort to deter and detect cyber threats, we periodically provide all employees, including part-time and temporary employees, with data protection, cybersecurity and incident response and prevention training as part of our overall IT compliance program, which covers timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security. This training functions to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Audit Committee
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]

Our Board of Directors administers its cybersecurity risk oversight function primarily through the Audit Committee of the Board of Directors. In accordance with our Audit Committee Charter, our Chief Information Officer, or CIO, provides periodic updates to our Audit Committee regarding the Company’s cybersecurity and other technology risks, internal controls and procedures, including the Company’s plan to mitigate cybersecurity risk and respond to data breaches. The Audit Committee is also responsible for reviewing any related periodic public filing disclosures. The Board of Directors receives regular reports from the Audit Committee. Our CIO also presents directly to our Board of Directors on an annual basis on these matters. Our IT team is responsible for maintaining daily operations and ensuring the confidentiality, integrity and availability of data. Our CIO oversees a cybersecurity team that has over 15 years’ experience in cybersecurity along with advanced and undergrad degrees in cybersecurity, and industry recognized security certifications such as CISSP (Certified Information Systems Security Professional) and CISM (Certified Information Security Manager). Our CIO reports directly to our Chief Legal Officer, both of whom are members of our executive committee leadership team. Cybersecurity incident status updates are provided as necessary to the executive committee as set forth in our GIRM. In the event of a cybersecurity incident, our IT team is trained to follow our GIRM.

Cybersecurity Risk Role of Management [Text Block]

In an effort to deter and detect cyber threats, we periodically provide all employees, including part-time and temporary employees, with data protection, cybersecurity and incident response and prevention training as part of our overall IT compliance program, which covers timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security. This training functions to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] cybersecurity team
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CIO oversees a cybersecurity team that has over 15 years’ experience in cybersecurity along with advanced and undergrad degrees in cybersecurity, and industry recognized security certifications such as CISSP (Certified Information Systems Security Professional) and CISM (Certified Information Security Manager).
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our CIO also presents directly to our Board of Directors on an annual basis on these matters. Our IT team is responsible for maintaining daily operations and ensuring the confidentiality, integrity and availability of data. Our CIO oversees a cybersecurity team that has over 15 years’ experience in cybersecurity along with advanced and undergrad degrees in cybersecurity, and industry recognized security certifications such as CISSP (Certified Information Systems Security Professional) and CISM (Certified Information Security Manager). Our CIO reports directly to our Chief Legal Officer, both of whom are members of our executive committee leadership team. Cybersecurity incident status updates are provided as necessary to the executive committee as set forth in our GIRM. In the event of a cybersecurity incident, our IT team is trained to follow our GIRM.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true