XML 53 R38.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Risk Management and Strategy
The Company’s process for assessing, identifying, evaluating and managing cybersecurity risks as part of its broader ERM program includes:
•Risk Identification and Prioritization: The Company employs various methods to assess and identify cybersecurity risks, which methods may, from time to time, include tabletop exercises to test our preparedness and incident response process, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, penetration tests, and engaging third parties to conduct analyses of our information security program. This process includes evaluating the likelihood and impact of potential cybersecurity incidents. The company engages third parties in connection with risk management processes.
•Continuous Risk Monitoring: The Company actively monitors cybersecurity risks including third-party risk from vendors and suppliers. Significant fluctuations in the prevalence or impact of such risks are reported to the Risk Committee on a quarterly basis.
•Mitigation Strategies: While continuous backups to a warm failover site are performed, the Company’s Incident Management and Information Security Plan is designed to identify and respond to security incidents and threats in a timely manner to minimize the loss or compromise of information assets and to facilitate incident resolution. In general, our incident response process follows the framework established by the National Institute of Standards and Technology (“NIST”) and focuses on four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident remediation. We also conduct mandatory annual cybersecurity training for all employees.
Cybersecurity Risks and Business Impact
To date, the Company has not been subject to cyberattacks that, individually or in the aggregate, have been material to our operations or financial condition. We do not believe that risks from cybersecurity threats are reasonably likely to materially affect our strategy, results of operations or financial condition over the long term. See the discussion of cybersecurity risk in Item 1A, “Risk Factors.”
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
The Company’s process for assessing, identifying, evaluating and managing cybersecurity risks as part of its broader ERM program includes:
•Risk Identification and Prioritization: The Company employs various methods to assess and identify cybersecurity risks, which methods may, from time to time, include tabletop exercises to test our preparedness and incident response process, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, penetration tests, and engaging third parties to conduct analyses of our information security program. This process includes evaluating the likelihood and impact of potential cybersecurity incidents. The company engages third parties in connection with risk management processes.
•Continuous Risk Monitoring: The Company actively monitors cybersecurity risks including third-party risk from vendors and suppliers. Significant fluctuations in the prevalence or impact of such risks are reported to the Risk Committee on a quarterly basis.
•Mitigation Strategies: While continuous backups to a warm failover site are performed, the Company’s Incident Management and Information Security Plan is designed to identify and respond to security incidents and threats in a timely manner to minimize the loss or compromise of information assets and to facilitate incident resolution. In general, our incident response process follows the framework established by the National Institute of Standards and Technology (“NIST”) and focuses on four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident remediation. We also conduct mandatory annual cybersecurity training for all employees.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] The Board’s Risk Committee provides oversight of cybersecurity and privacy risks, including overseeing management’s efforts to monitor and mitigate those risks and reviewing with management any significant privacy and cybersecurity incidents and the effectiveness of the Incident Management and Information Security Plan.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Board’s Risk Committee provides oversight of cybersecurity and privacy risks, including overseeing management’s efforts to monitor and mitigate those risks and reviewing with management any significant privacy and cybersecurity incidents and the effectiveness of the Incident Management and Information Security Plan.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The CIO and IT Management inform key management personnel on relevant cybersecurity issues, which can span a wide range of topics, including but not limited to recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, and the current threat environment.
Cybersecurity Risk Role of Management [Text Block]
IT Department
The Company has appointed our CIO to establish, implement, and carryout our cybersecurity risk management policies and processes, including the Incident Management and Information Security Plan, and to facilitate the communication of such matters to the Risk Committee and the Board. Our CIO and other IT senior members of management responsible for our cybersecurity program have extensive experience assessing and managing cybersecurity risks. Our CIO and Security Team have over 30 years of experience in information technology and cybersecurity positions.
Internal Audit
Periodic audits are performed by our Internal Audit team as part of the Company’s compliance with the Incident Management and Information Security Plan and the overall ERM framework.
Chief Risk Officer
The ERM structure is further bolstered by the support of a dedicated Chief Risk Officer, who provides specialized expertise and oversight in the broader domain of risk management.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Company has appointed our CIO to establish, implement, and carryout our cybersecurity risk management policies and processes, including the Incident Management and Information Security Plan, and to facilitate the communication of such matters to the Risk Committee and the Board. Our CIO and other IT senior members of management responsible for our cybersecurity program have extensive experience assessing and managing cybersecurity risks.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CIO and other IT senior members of management responsible for our cybersecurity program have extensive experience assessing and managing cybersecurity risks. Our CIO and Security Team have over 30 years of experience in information technology and cybersecurity positions.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The CIO and IT Management inform key management personnel on relevant cybersecurity issues, which can span a wide range of topics, including but not limited to recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, and the current threat environment.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true