XML 87 R29.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
As a critical infrastructure company, we regularly face cybersecurity threats from malicious third parties that could obtain unauthorized access to our internal systems, networks and data. It is virtually impossible for us to entirely mitigate the risk of these and other security threats we face. The security, performance, and reliability of our network may in the future be disrupted by third parties, including nation-states, competitors, hackers, disgruntled employees, former employees, or contractors. While we have implemented security measures internally and have integrated security measures into our systems, network, and products, these measures have not always functioned as expected and have not always detected or prevented all unauthorized activity, prevented all security breaches or incidents, mitigated all security breaches or incidents, or protected against all attacks or incidents.

We have implemented processes and procedures for the assessment, identification, and management of material risks from cybersecurity threats. These processes implement both qualitative and quantitative measurements that have been agreed upon with our third-party consultants, our auditors, and integrated into our overall risk management process.

Our process includes assessing, mitigating, and managing risk in three categories: cybersecurity or technical risk, vendor risk, and compliance and regulatory risk. To support those risk management categories, we partner with third parties in the implementation of tooling to help us decrease cyber risks and ensure compliance within Allegiant and with third parties. We verify third-party compliance, such as suppliers and business partners, by aligning with several standards. For example, we subject our IT suppliers to the Sarbanes-Oxley ("SOX") and payment card industry ("PCI") compliance standards where applicable.

As a publicly traded company and given the industry in which we operate, we have established a risk-based strategy informed by numerous cybersecurity frameworks from regulatory bodies such as PCI, SOX, FAA, TSA, DOT, NIST and DoD. We use the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet all of the technical standards, specifications or requirements under any of these frameworks. Achieving compliance with any cybersecurity standard does not guarantee that controls cannot be broken, bypassed, or circumvented by zero-day vulnerabilities, or malicious threat actors.

Our overall approach to cybersecurity risk management includes the following key elements:

Multi-layered defenses, coupled with in-depth and continuous monitoring – We utilize data analytics to detect anomalies and search for cybersecurity threats. From time to time, we engage third party consultants or other advisors to assist in assessing, identifying and managing cybersecurity threats. We also periodically use our internal audit function to conduct additional assessments and reviews.
Insider Threats – We maintain an insider threat program, designed to identify, assess, and address potential risks from within Allegiant. Our program evaluates potential risks consistent with industry best practices, customer requirements and applicable law, including privacy and other considerations.
Information Sharing and Collaboration – We work with government, customer, industry and supplier partners including government-industry partnerships and critical infrastructure threat intelligence sharing platforms. These relationships enable the rapid sharing of threat intelligence and vulnerability mitigation across the industry and the defense industrial base and supply chain.
Third Party Risk Assessments – We conduct information security assessments before sharing or allowing the hosting of sensitive information in our computing environments, and those managed by third parties. Our standard terms and conditions with third parties include contractual provisions requiring certain security protections.
Training and Awareness – We seek to create a culture of security. We provide training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees are required to participate in cybersecurity training at least annually and our training includes spear phishing and other awareness training. We regularly remind our employees and partners of the importance of handling and protecting customer and employee data, including through annual privacy and security training. We also host periodic tabletop exercises and drills with management and other employees to practice rapid response to cyber incidents.
Supplier Engagement – We require our suppliers to comply with our standard information security terms and conditions and require them to complete information security questionnaires to enable us to review and assess any potential cyber-related risks depending on the nature of the services provided.
Scalability – We continue to invest directly in our cybersecurity program, as well as augmentation of those cybersecurity services through managed services and third parties, depending on the maturity and risk of the operating model of the business unit.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] We have implemented processes and procedures for the assessment, identification, and management of material risks from cybersecurity threats. These processes implement both qualitative and quantitative measurements that have been agreed upon with our third-party consultants, our auditors, and integrated into our overall risk management process.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Our board is responsible for overseeing our enterprise risk management activities in general, the appropriate committees assist the board in the role of risk oversight. Our chief information security officer (CISO) presents a quarterly update to the full board, including an update on our risk management process and risk trends related to cybersecurity.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our board is responsible for overseeing our enterprise risk management activities in general, the appropriate committees assist the board in the role of risk oversight. Our chief information security officer (CISO) presents a quarterly update to the full board, including an update on our risk management process and risk trends related to cybersecurity.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Our CISO leads our day-to-day data security and customer privacy efforts — overseeing operations, cybersecurity, privacy risk and compliance. The CISO, who has more than 30 years of experience reports regularly to our chief executive officer (CEO), monthly to the risk and compliance committee (consisting of executive leadership) and quarterly to our board.
Cybersecurity Risk Role of Management [Text Block]
We have a dedicated cybersecurity team, composed of individuals with a diverse set of information security, cybersecurity, and governance, risk and compliance backgrounds, collectively giving our cybersecurity program significant experience. Our CISO leads our day-to-day data security and customer privacy efforts — overseeing operations, cybersecurity, privacy risk and compliance. The CISO, who has more than 30 years of experience reports regularly to our chief executive officer (CEO), monthly to the risk and compliance committee (consisting of executive leadership) and quarterly to our board.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
We have a dedicated cybersecurity team, composed of individuals with a diverse set of information security, cybersecurity, and governance, risk and compliance backgrounds, collectively giving our cybersecurity program significant experience. Our CISO leads our day-to-day data security and customer privacy efforts — overseeing operations, cybersecurity, privacy risk and compliance. The CISO, who has more than 30 years of experience reports regularly to our chief executive officer (CEO), monthly to the risk and compliance committee (consisting of executive leadership) and quarterly to our board.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The CISO, who has more than 30 years of experience reports regularly to our chief executive officer (CEO), monthly to the risk and compliance committee (consisting of executive leadership) and quarterly to our board.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our chief information security officer (CISO) presents a quarterly update to the full board, including an update on our risk management process and risk trends related to cybersecurity.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true