XML 31 R12.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 28, 2024 | Dec. 28, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |  |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | The Company recognizes the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees, customers or the independent commission sales agents and third party capacity providers in our network; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented cybersecurity processes, technologies, and controls to aid in its efforts to assess, identify, and manage such risks, including network and endpoint monitoring by a third party managed security services provider and Landstar IT professionals, access controls, vulnerability assessments, penetration testing, regular information security training for employees, and tabletop exercises to inform our IT professionals’ risk identification and assessment. Landstar maintains an Incident Response Plan that guides the actions the Company is to take in the event of a suspected or confirmed cybersecurity incident. The plan includes processes to triage, investigate, contain, and remediate the incident, and is designed to enable us to comply with applicable legal and regulatory obligations and mitigate financial and reputational damage. We also maintain a Business Continuity Plan, which provides procedures for maintaining the continuity of critical business processes in the event of business interruption, including any that involve cybersecurity incidents that may significantly impact our operations. Our cybersecurity risk management processes incorporate appropriate industry standards and are designed using the frameworks developed by National Institute of Standards and Technology (“NIST”) as a guide. Our enterprise risk management program reports at least quarterly to the Management Risk Committee and considers cybersecurity threat risks alongside other types of risks as part of our overall risk assessment process. The Management Risk Committee consists of those members of executive management of the Company with ultimate responsibility for the Company’s enterprise risk management practices. Members of the Management Risk Committee regularly engage in discussions and meetings relating to cybersecurity risk management and strategy processes and the prevention, detection, mitigation and remediation of cybersecurity incidents. Members of our IT department collaborate with the Management Risk Committee, as necessary, to gather insights for identifying and assessing cybersecurity threats, their severity, and potential mitigations. Our cybersecurity risk management and strategy processes are led by the Chief Information Officer and the Vice President of Network Services, who are each members of the Management Risk Committee . In particular, the Vice President of Network Services leads a team of IT professionals that includes individuals with significant cybersecurity expertise. The Vice President of Network Services has over 27 years of experience in various roles with the Company as well as with the U.S. Army involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. The team of IT professionals led by the Vice President of Network Services includes individuals with relevant degrees and certifications, including Certified Information Security Systems Professional (CISSP), GIAC Foundational Cybersecurity Technologies (GFACT), GIAC Certified Incident Handler Certification (GCIH), GIAC Security Essentials (GSEC), ITIL 4 Foundations, Qualys Certified Specialist - Vulnerability Management Detection & Response, Microsoft Technology Associate: Security Fundamentals, Google Cloud Certified: Professional Cloud Security Engineer, Cisco Certified CyberOps Associate, Cisco Certified Network Associate (CCNA), CompTIA Security+, and CompTIA Pentest+. The Company also regularly engages with consultants, auditors, and other third parties, including by having an independent third party Qualified Security Assessor review our cybersecurity program twice each year to help identify areas for continued focus and enhancement. These third parties analyze data on the interactions of users of our information technology resources, including employees, and conduct penetration tests and vulnerability scanning exercises to assess the performance of our cybersecurity controls, systems and processes. Our cybersecurity risk management processes also address risks associated with our use of third party service providers, including those who have access to our employee data or our systems that support customers and our network of independent commission sales agents and third party capacity providers. Third party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program. Cybersecurity considerations affect the selection and oversight of our third party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threats identified through such diligence. Additionally, we may require certain third parties to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate. During the period covered by this Annual Report, the Company has not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, institutions like us, as well as our employees, service providers and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of increasingly sophisticated cyber attacks. The Company describes whether and how risks from identified cybersecurity threats materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “Disruptions or failures in the Company’s computer systems; cyber and other information security incidents” included as part of our risk factor disclosure at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein. Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Safety and Risk Committee of the Board is responsible for the oversight of risks from cybersecurity threats. At least semi-annually, the Management Risk Committee and, subsequently, the Safety and Risk Committee of the Board receive an overview of our cybersecurity threat risk management and strategy processes from the Chief Information Officer and the Vice President of Network Services. These sessions typically cover topics such as data security posture, results from third party assessments, progress towards risk-mitigation-related goals, our incident response plan, cybersecurity vendors and products, and material risks from cybersecurity threats, incidents and developments, as well as the steps management has taken to respond to such risks. Material cybersecurity threat risks are also considered during separate Board and Board committee meeting discussions relating to matters such as enterprise risk management, IT strategy, internal controls over financial reporting and business continuity planning. |
Cybersecurity Risk Management Processes Integrated [Flag] |  | true
Cybersecurity Risk Management Processes Integrated [Text Block] | The Company recognizes the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees, customers or the independent commission sales agents and third party capacity providers in our network; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented cybersecurity processes, technologies, and controls to aid in its efforts to assess, identify, and manage such risks, including network and endpoint monitoring by a third party managed security services provider and Landstar IT professionals, access controls, vulnerability assessments, penetration testing, regular information security training for employees, and tabletop exercises to inform our IT professionals’ risk identification and assessment. |
Cybersecurity Risk Management Third Party Engaged [Flag] |  | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] |  | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] |  | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] | During the period covered by this Annual Report, the Company has not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, institutions like us, as well as our employees, service providers and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of increasingly sophisticated cyber attacks. The Company describes whether and how risks from identified cybersecurity threats materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “Disruptions or failures in the Company’s computer systems; cyber and other information security incidents” included as part of our risk factor disclosure at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein. |
Cybersecurity Risk Board of Directors Oversight [Text Block] | Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Safety and Risk Committee of the Board is responsible for the oversight of risks from cybersecurity threats. At least semi-annually, the Management Risk Committee and, subsequently, the Safety and Risk Committee of the Board receive an overview of our cybersecurity threat risk management and strategy processes from the Chief Information Officer and the Vice President of Network Services. These sessions typically cover topics such as data security posture, results from third party assessments, progress towards risk-mitigation-related goals, our incident response plan, cybersecurity vendors and products, and material risks from cybersecurity threats, incidents and developments, as well as the steps management has taken to respond to such risks. Material cybersecurity threat risks are also considered during separate Board and Board committee meeting discussions relating to matters such as enterprise risk management, IT strategy, internal controls over financial reporting and business continuity planning. |
Cybersecurity Risk Management Positions or Committees Responsible [Flag] |  | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | The Management Risk Committee consists of those members of executive management of the Company with ultimate responsibility for the Company’s enterprise risk management practices. Members of the Management Risk Committee regularly engage in discussions and meetings relating to cybersecurity risk management and strategy processes and the prevention, detection, mitigation and remediation of cybersecurity incidents. Members of our IT department collaborate with the Management Risk Committee, as necessary, to gather insights for identifying and assessing cybersecurity threats, their severity, and potential mitigations. Our cybersecurity risk management and strategy processes are led by the Chief Information Officer and the Vice President of Network Services, who are each members of the Management Risk Committee . |
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | In particular, the Vice President of Network Services leads a team of IT professionals that includes individuals with significant cybersecurity expertise. The Vice President of Network Services has over 27 years of experience in various roles with the Company as well as with the U.S. Army involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. The team of IT professionals led by the Vice President of Network Services includes individuals with relevant degrees and certifications, including Certified Information Security Systems Professional (CISSP), GIAC Foundational Cybersecurity Technologies (GFACT), GIAC Certified Incident Handler Certification (GCIH), GIAC Security Essentials (GSEC), ITIL 4 Foundations, Qualys Certified Specialist - Vulnerability Management Detection & Response, Microsoft Technology Associate: Security Fundamentals, Google Cloud Certified: Professional Cloud Security Engineer, Cisco Certified CyberOps Associate, Cisco Certified Network Associate (CCNA), CompTIA Security+, and CompTIA Pentest+. |

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration