XML 95 R32.htm IDEA: XBRL DOCUMENT v3.25.3
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Sep. 30, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We have developed and implemented an enterprise-wide cybersecurity program designed to provide a structured and thorough cybersecurity risk management system and governance structure to assess, identify, and manage material risks from cybersecurity threats. The Company considers the following factors, among others, to assess whether adequate protections are in place to address risks from known and anticipated cybersecurity threats: likelihood and severity of risk, impact on the Company and others, including retail customers, suppliers, consumers, and/or employees, if a risk materializes; feasibility and cost of controls; and impact of controls on our operations.
Our cybersecurity program is aligned with various frameworks for managing cybersecurity risks, such as the National Institute of Standards and Technology Cyber Security Framework for IT systems and International Electrotechnical Commission 62443 which governs cybersecurity for Industrial Control Systems. Our cybersecurity program prioritizes, among other things, prevention of unauthorized access; protection of sensitive information; detection, assessment, and response to cyber threats; and continuous improvements to our cybersecurity measures. We seek to achieve our cybersecurity program priorities through a multi-pronged and -tiered approach to address cyber threats and incidents that includes implementation of various industry best practices, proactive monitoring of our IT systems, ongoing employee training, and regular risk assessments. We also maintain cyber insurance coverage to help mitigate a portion of the potential costs in the event of covered events.
As part of the cybersecurity risk management program, the Company utilizes cybersecurity assessors, consultants, auditors, and other third parties to assist the internal team with network security, cloud security, endpoint security, data loss prevention, and security information and event management. In addition, the Company utilizes a variety of third-party technology, information systems, and service providers to help identify, isolate, and mitigate security incidents. The Information Security team retains external cybersecurity firms to review and provide feedback on improving our cybersecurity program, including in the areas of data protection, threat and vulnerability management, and end-point protection. Tabletop exercises are conducted to prepare for potential cyber incidents and assess preparedness and processes. Cybersecurity training is provided to users of the Company technology resources, regular simulated exercises are conducted to help recognize phishing emails and other social engineering tactics and provide various methods for users to report suspicious activity that may give rise to a cyber incident or threat. Significant results of such testing and reviews are communicated to our executive management team and our Audit Committee, as applicable, and are utilized in our cybersecurity program’s continuous improvement process.
In response to the growing risks associated with third-party service providers, we have established review processes for assessing the technological and information security controls of our third-party suppliers to attempt to identify material cybersecurity risks associated with such providers, their IT systems, and their access to our IT systems that could significantly disrupt our operations. These processes encompass a range of measures, such as pre-engagement cybersecurity due diligence for providers who access our IT systems or information before their engagement, ongoing monitoring and evaluation of our providers, detailed examination of available System and Organization Controls attestation reports, and inclusion of relevant contractual provisions in our agreements with third-party service providers with respect to areas including cyber protections, notifications, auditing, and risk allocation.
To support incident response preparedness, the Company has developed a cybersecurity incident response plan and conducts an annual simulated incident exercise. The cybersecurity incident response plan addresses cybersecurity incidents that directly impact the Company or arise from the Company’s use of third-party technology, information systems, and service providers. The Company also utilizes business continuity and disaster recovery plans to prepare for potential disruptions in technology that the Company relies upon. Further, the Company monitors novel and advanced cybersecurity threats and provides ongoing employee security awareness training.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
We have developed and implemented an enterprise-wide cybersecurity program designed to provide a structured and thorough cybersecurity risk management system and governance structure to assess, identify, and manage material risks from cybersecurity threats. The Company considers the following factors, among others, to assess whether adequate protections are in place to address risks from known and anticipated cybersecurity threats: likelihood and severity of risk, impact on the Company and others, including retail customers, suppliers, consumers, and/or employees, if a risk materializes; feasibility and cost of controls; and impact of controls on our operations.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. The Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Audit Committee. In connection with that oversight responsibility, our Chief Information Officer ("CIO") provides the Audit Committee and the senior executive management team of the Company information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape. Our head of Internal Audit also meets with our executive management team and the Audit Committee on a quarterly basis and reports on processes and activities, including applicable cyber risk management, pertinent to enterprise risk management.
Our enterprise-wide cybersecurity program is managed by a dedicated information security team, led by our CIO. Our CIO has more than 25 years of technology experience across various disciplines, including nearly 15 years of experience as a CISO in the financial, manufacturing, and the consumer packaged goods industries. He has led our global information security organization for almost four years. In addition to his employment experience in the cybersecurity field, our CIO has a Master of Computer Systems and a Bachelor’s Degree in Accounting, and he has served on corporate and industry advisory boards related to cybersecurity, all of which have provided him with skills and experience to manage our global information security function. Our CIO regularly meets with other members of our executive team and provides relevant updates on our cybersecurity program.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. The Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Audit Committee.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] In connection with that oversight responsibility, our Chief Information Officer ("CIO") provides the Audit Committee and the senior executive management team of the Company information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape. Our head of Internal Audit also meets with our executive management team and the Audit Committee on a quarterly basis and reports on processes and activities, including applicable cyber risk management, pertinent to enterprise risk management.
Cybersecurity Risk Role of Management [Text Block]
Our enterprise-wide cybersecurity program is managed by a dedicated information security team, led by our CIO. Our CIO has more than 25 years of technology experience across various disciplines, including nearly 15 years of experience as a CISO in the financial, manufacturing, and the consumer packaged goods industries. He has led our global information security organization for almost four years. In addition to his employment experience in the cybersecurity field, our CIO has a Master of Computer Systems and a Bachelor’s Degree in Accounting, and he has served on corporate and industry advisory boards related to cybersecurity, all of which have provided him with skills and experience to manage our global information security function. Our CIO regularly meets with other members of our executive team and provides relevant updates on our cybersecurity program.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
Our enterprise-wide cybersecurity program is managed by a dedicated information security team, led by our CIO. Our CIO has more than 25 years of technology experience across various disciplines, including nearly 15 years of experience as a CISO in the financial, manufacturing, and the consumer packaged goods industries. He has led our global information security organization for almost four years. In addition to his employment experience in the cybersecurity field, our CIO has a Master of Computer Systems and a Bachelor’s Degree in Accounting, and he has served on corporate and industry advisory boards related to cybersecurity, all of which have provided him with skills and experience to manage our global information security function. Our CIO regularly meets with other members of our executive team and provides relevant updates on our cybersecurity program.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CIO has more than 25 years of technology experience across various disciplines, including nearly 15 years of experience as a CISO in the financial, manufacturing, and the consumer packaged goods industries. He has led our global information security organization for almost four years. In addition to his employment experience in the cybersecurity field, our CIO has a Master of Computer Systems and a Bachelor’s Degree in Accounting, and he has served on corporate and industry advisory boards related to cybersecurity, all of which have provided him with skills and experience to manage our global information security function.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our CIO regularly meets with other members of our executive team and provides relevant updates on our cybersecurity program.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true