XML 89 R37.htm IDEA: XBRL DOCUMENT
v3.25.4

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Cybersecurity Risk Management Program The Program is designed to identify, assess, manage, mitigate, and respond to cyber threats with the goal of preventing cybersecurity incidents to the extent feasible, while also increasing our system resilience to minimize business disruption in the event we experience a cyber event. Our program is structured to be nimble and adaptable to changes in cybersecurity threats over time and to respond to emerging threats in a timely and efficient manner. Our Program consists of a layered cybersecurity approach and is incorporated into our overall ERM program. The Program is evaluated on a regular basis, at least annually, and adjustments to the Program are made based on the results of these evaluations and changes to industry standards. The Company maintains a Third-Party Risk Management program to manage risks related to third-party relationships in a manner that is consistent with the Company’s risk appetite. This includes risk and control assessments to provide for the appropriate safeguarding of sensitive information. The Company has a dedicated internal Security Operations Center ("SOC") and a Managed Detection and Response ("MDR") third party service that provides 24/7/365 monitoring of its environment to investigate and respond to security alerts. Log sources are mapped to the MITRE ATT&CK framework to ensure appropriate security monitoring and gap analysis to detect and respond to attacks. Threat intelligence is used with contextual risk approaches to identify threats and prioritize response. Threat hunts operate both proactively and reactively to look for relevant behaviors and indicators of compromise from cybersecurity events or zero-day vulnerabilities. The Company maintains an Incident Response Plan that is designed to timely and effectively address the handing of security incidents. This includes providing the Company with a detailed outline of how to respond to a security incident, team responsibilities, contact information for key resources, definitions for determining the severity and escalation of security incidents, and pre-built playbooks to respond to the most common types of security incidents including ransomware. Incident response and escalation plans are tested and reviewed for improvements at least annually. An incident response retainer with an approved third party is contracted to assist in responding to security incidents and to conduct forensic investigations involving the potential compromise of sensitive data or information assets. All employees are required to complete privacy and information security awareness training upon joining the Company and on an annual basis. This includes incident response training on how to communicate potential or actual incidents. Our Company faces a number of cybersecurity risks in connection with the operation of our business which could have a material adverse effect on our business financial condition, results of operations, cash flows, or reputation. Although, to date, such risks have not materially affected us, we have, from time to time, experienced threats to and breaches of our data, including breaches caused by human error or breaches affecting third parties of the Company. For more information about the cybersecurity risks we face, see the risk factors entitled “We face continuing and growing security risks to our information base, including the information we maintain relating to our customers.” and “We rely on other companies to provide key components of our business infrastructure.” in Item 1A- Risk Factors.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | The Program is designed to identify, assess, manage, mitigate, and respond to cyber threats with the goal of preventing cybersecurity incidents to the extent feasible, while also increasing our system resilience to minimize business disruption in the event we experience a cyber event. Our program is structured to be nimble and adaptable to changes in cybersecurity threats over time and to respond to emerging threats in a timely and efficient manner. Our Program consists of a layered cybersecurity approach and is incorporated into our overall ERM program.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | The Company’s Chief Security Officer ("CSO") has primary responsibility for assessing and managing the Program and reporting on cybersecurity matters to the Board of Directors. The CSO reports directly to the Chief Information Officer. The CSO is responsible for the implementation, maintenance, and enforcement of the Program. The CSO has extensive experience managing information security systems and holds the Certification Information Systems Manager (CISM) designation. Our CSO regularly updates members of executive management on developments surrounding cybersecurity. The CSO reports to the Risk Committee of the Board of Directors and provides regular reports to the Risk Committee on emerging cybersecurity issues and the Company’s cybersecurity infrastructure. The Program is overseen by the Board of Directors which has delegated certain responsibilities to the Risk Committee. The Board of Directors oversees management’s processes for identifying and mitigating risks, including cyber risks, to assist in the alignment of the Company’s risk exposure with the Company’s overall risk tolerances. The Board of Directors has also engaged an experienced information security advisor to assist with cybersecurity and data privacy oversight responsibilities. This advisor provides the Board of Directors with independent updates on external market cybersecurity threats and emerging risks on a regular basis. The Risk Committee, the Audit Committee, and the Board of Directors are active in understanding and evaluating cybersecurity risks. The Risk Committee receives and reviews a quarterly Enterprise Risk Management (“ERM”) report from the Chief Risk Officer that is the cumulation of a process that involves discussions with leaders across the Company and incorporates a number of enterprise risk factors, including those related to cybersecurity threats. The Audit Committee receives the results of internal and external penetration testing as well as any other audits applicable to the Company’s information security programs. The Audit Committee actively engages management in discussions surrounding the outcome of these audits. At least annually, the Risk Committee receives a report from the CSO covering the Company’s Program. This report includes a review of the overall status of the Program, any material matters related to the Program, enhancements made or recommended to be made to the Program, a discussion of management’s actions to identify and detect threats, Key Risk Indicators and planned action steps in the event of an incident, an overview of the results of testing, any security breaches or violations, and an overview of employee training and engagement efforts. The Chair of the Risk Committee reports to the Board of Directors on this presentation. In addition, separately, on at least an annual basis, the Risk Committee receives updates from the CSO on the Company’s Incident Response Plan, which outlines steps to be followed in the event of an incident including detection, mitigation, recovery, and notification (including notification to senior management, the Board of Directors, and functional business areas), and remediation.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Program is overseen by the Board of Directors which has delegated certain responsibilities to the Risk Committee. The Board of Directors oversees management’s processes for identifying and mitigating risks, including cyber risks, to assist in the alignment of the Company’s risk exposure with the Company’s overall risk tolerances. The Board of Directors has also engaged an experienced information security advisor to assist with cybersecurity and data privacy oversight responsibilities. This advisor provides the Board of Directors with independent updates on external market cybersecurity threats and emerging risks on a regular basis.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | At least annually, the Risk Committee receives a report from the CSO covering the Company’s Program. This report includes a review of the overall status of the Program, any material matters related to the Program, enhancements made or recommended to be made to the Program, a discussion of management’s actions to identify and detect threats, Key Risk Indicators and planned action steps in the event of an incident, an overview of the results of testing, any security breaches or violations, and an overview of employee training and engagement efforts. The Chair of the Risk Committee reports to the Board of Directors on this presentation. In addition, separately, on at least an annual basis, the Risk Committee receives updates from the CSO on the Company’s Incident Response Plan, which outlines steps to be followed in the event of an incident including detection, mitigation, recovery, and notification (including notification to senior management, the Board of Directors, and functional business areas), and remediation.
Cybersecurity Risk Role of Management [Text Block] | The Company has a dedicated internal Security Operations Center ("SOC") and a Managed Detection and Response ("MDR") third party service that provides 24/7/365 monitoring of its environment to investigate and respond to security alerts. Log sources are mapped to the MITRE ATT&CK framework to ensure appropriate security monitoring and gap analysis to detect and respond to attacks. Threat intelligence is used with contextual risk approaches to identify threats and prioritize response. Threat hunts operate both proactively and reactively to look for relevant behaviors and indicators of compromise from cybersecurity events or zero-day vulnerabilities. The Company maintains an Incident Response Plan that is designed to timely and effectively address the handing of security incidents. This includes providing the Company with a detailed outline of how to respond to a security incident, team responsibilities, contact information for key resources, definitions for determining the severity and escalation of security incidents, and pre-built playbooks to respond to the most common types of security incidents including ransomware. Incident response and escalation plans are tested and reviewed for improvements at least annually. An incident response retainer with an approved third party is contracted to assist in responding to security incidents and to conduct forensic investigations involving the potential compromise of sensitive data or information assets. All employees are required to complete privacy and information security awareness training upon joining the Company and on an annual basis. This includes incident response training on how to communicate potential or actual incidents.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | The Company’s Chief Security Officer ("CSO") has primary responsibility for assessing and managing the Program and reporting on cybersecurity matters to the Board of Directors.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The CSO has extensive experience managing information security systems and holds the Certification Information Systems Manager (CISM) designation. Our CSO regularly updates members of executive management on developments surrounding cybersecurity.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Our CSO regularly updates members of executive management on developments surrounding cybersecurity. The CSO reports to the Risk Committee of the Board of Directors and provides regular reports to the Risk Committee on emerging cybersecurity issues and the Company’s cybersecurity infrastructure.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration