XML 49 R30.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 28, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Our cybersecurity program and policies establish the responsibilities of individuals and committees tasked with oversight of security risk management and provide broad directives that support implementation for identifying, assessing and managing risks from cybersecurity threats. We conduct an annual information security risk assessment which includes a review of the organization’s performance of administrative, technical and physical safeguards protecting personal and confidential information. Information security related policies are reviewed on an annual basis and approved by the owners of each functional area.
We engage independent third-parties to conduct ethical hacks of key systems, aiding our understanding of control effectiveness and facilitating the implementation of more robust controls. We periodically engage with a third-party assessment firm to conduct reviews of our overall program and to examine our security controls to help us better align our cybersecurity
program with industry standards. To monitor and decrease the risks from cybersecurity threats associated with our use of third-party service providers, potential new vendors with a greater degree of system or data access are subjected to a security vetting process prior to engagement. Existing critical vendors that store or process company or client information are reviewed annually through commercially reasonable efforts such as questionnaires.
In the event of a cybersecurity incident which jeopardizes the confidentiality, integrity, or availability of our information and technology infrastructure and systems, we utilize a regularly tested incident response plan. The plan defines an organized approach to dealing with cybersecurity incidents, and identifies roles, responsibilities and escalation protocols. The plan is designed to provide an orderly response to incidents, minimize impact, initiate appropriate communications internally and externally, and identify recommendations to mitigate future incidents.
Cybersecurity incidents may be detected through a variety of means, including employee notification to our IT personnel, notification from external parties (e.g., customers, vendors, or service providers), and automated event-detection notifications. Once a potential cybersecurity incident is identified, IT personnel assigned to the incident assess the severity of the event and sensitivity of any compromised data and follow the reporting and escalation procedures set forth in the incident response plan. Events that could have a high impact or that require additional judgment are escalated to the ISC. The ISC designates an incident response team to continue investigation of the incident to determine the extent of exposure and damage, and works to contain the damage and isolate the affected system, apply security measures and ultimately recover systems.
Should a cybersecurity incident be escalated to the ISC, the ISC notifies the Chief Legal Counsel in his capacity as chair of the ERC. In the event of a cybersecurity incident that meets certain characteristics as defined in the incident response plan, the Chief Legal Counsel, as chair of the ERC, would inform the Board of Directors or the executive committee thereof.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
Our cybersecurity program and policies establish the responsibilities of individuals and committees tasked with oversight of security risk management and provide broad directives that support implementation for identifying, assessing and managing risks from cybersecurity threats. We conduct an annual information security risk assessment which includes a review of the organization’s performance of administrative, technical and physical safeguards protecting personal and confidential information. Information security related policies are reviewed on an annual basis and approved by the owners of each functional area.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Our management is responsible for the day-to-day management of the risks that we face, while our Board of Directors, as a whole, has responsibility for the oversight of our enterprise risk management, including cybersecurity. Under the oversight of the Board of Directors, cybersecurity risk is managed under the direction of our Information Security department, the Information Security Council ("ISC") and the Enterprise Risk Committee (“ERC”).
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The ISC is a standing committee that acts as a point of escalation for security incidents and is headed by our Chief Information Officer (“CIO”).
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The ISC is a standing committee that acts as a point of escalation for security incidents and is headed by our Chief Information Officer (“CIO”). Our CIO has over 20 years of experience in the IT field, holds a Bachelor of Science in Information Systems and is Microsoft Certified Solutions Expert (MCSE) certified. Other members of the ISC include IT senior leadership, IT operations and corporate management and a member from our Forensic & Cyber Investigations practice. Other members of the ISC have work experience related to information security issues and/or hold industry certificates, including Certified Information Systems Security Professional (CISSP). The ERC is a standing committee providing oversight on overall enterprise risk. The ERC is chaired by our Chief Legal Counsel and is composed of representatives from senior management.
Cybersecurity Risk Role of Management [Text Block] Our management is responsible for the day-to-day management of the risks that we face, while our Board of Directors, as a whole, has responsibility for the oversight of our enterprise risk management, including cybersecurity. Under the oversight of the Board of Directors, cybersecurity risk is managed under the direction of our Information Security department, the Information Security Council ("ISC") and the Enterprise Risk Committee (“ERC”). The ISC is a standing committee that acts as a point of escalation for security incidents and is headed by our Chief Information Officer (“CIO”). Our CIO has over 20 years of experience in the IT field, holds a Bachelor of Science in Information Systems and is Microsoft Certified Solutions Expert (MCSE) certified. Other members of the ISC include IT senior leadership, IT operations and corporate management and a member from our Forensic & Cyber Investigations practice. Other members of the ISC have work experience related to information security issues and/or hold industry certificates, including Certified Information Systems Security Professional (CISSP). The ERC is a standing committee providing oversight on overall enterprise risk. The ERC is chaired by our Chief Legal Counsel and is composed of representatives from senior management. The Board of Directors receives regular updates and reports from members of senior management regarding our cybersecurity risks and protection measures, including any notable cybersecurity incidents, and evaluates risks posed by cybersecurity threats.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The ISC is a standing committee that acts as a point of escalation for security incidents and is headed by our Chief Information Officer (“CIO”).
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CIO has over 20 years of experience in the IT field, holds a Bachelor of Science in Information Systems and is Microsoft Certified Solutions Expert (MCSE) certified. Other members of the ISC include IT senior leadership, IT operations and corporate management and a member from our Forensic & Cyber Investigations practice. Other members of the ISC have work experience related to information security issues and/or hold industry certificates, including Certified Information Systems Security Professional (CISSP).
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
Cybersecurity incidents may be detected through a variety of means, including employee notification to our IT personnel, notification from external parties (e.g., customers, vendors, or service providers), and automated event-detection notifications. Once a potential cybersecurity incident is identified, IT personnel assigned to the incident assess the severity of the event and sensitivity of any compromised data and follow the reporting and escalation procedures set forth in the incident response plan. Events that could have a high impact or that require additional judgment are escalated to the ISC. The ISC designates an incident response team to continue investigation of the incident to determine the extent of exposure and damage, and works to contain the damage and isolate the affected system, apply security measures and ultimately recover systems.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true