XML 58 R40.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We, together with our third-party vendors, employ information technology including networks, systems, and applications to support our business and decision-making across the Company, including supporting the flow of information across our business processes. Our information technology infrastructure is susceptible to cybersecurity threats. We monitor our information technology systems, including through the use of information security procedures and risk management systems, and implement initiatives aimed at improving our cybersecurity measures. Our process for assessing, identifying, managing and addressing information security risks include:

Internalization of Information Security Management. We have internalized our information security oversight by hiring a full time Head of Information Technology that has over 20 years of experience in managing information technology and guiding organizations through technology strategy, cybersecurity risk mitigation, information technology process improvement initiatives and digital transformations. He also possesses relevant experience in improving a company's cybersecurity posture and data privacy policies. He holds a Bachelor of Science degree in Information Systems and oversees all of our information security initiatives, assesses cybersecurity risks, provides cybersecurity plans, identifies opportunities for the implementation of additional cybersecurity measures and provides cybersecurity training to our employees and executives.

Third-Party Consultant. We engage a third-party information security consultant to assist in managing our risk posture. This consultant conducts periodic tests and analyses of our defensive and detective information security controls, including annual penetration tests and risk assessments as well as regular vulnerability scans and assessments. The consultant also provides live, interactive annual information security training to our employees and executive officers and monitors the effectiveness of such training through quarterly phishing campaigns. The consultant also assists us in managing cybersecurity risks associated with third-party service providers by administering a due diligence questionnaire for the Company's third-party service providers that includes a cybersecurity risk assessment and provides guidance for remediation of security gaps.

Current Plans and Procedures. The Company has implemented and maintains an incident response plan (“IRP”) and a Business Continuity Plan (“BCP”). The IRP establishes the organization, actions and procedures for recognizing and responding to information security incidents; assessing incidents; notifying the appropriate individuals, regulators or organizations about any incident; organizing the Company’s response activities; escalating the Company’s response efforts to named executive officers and the Board of Directors based on the severity of the incident; and supporting the business recovery efforts made in the aftermath of any incident. The IRP is designed to minimize the operational and financial impacts of an information security incident and is designed to be activated when a local incident responder determines that an incident has occurred. Similarly, our BCP provides details on information security incident response and subsequent business recovery actions.

Risk Identification and Mitigation. The Company aims to identify and mitigate information security risks by using the National Institute of Standards and Technology Cybersecurity Framework (the “NIST Framework”) as a guide to help us identify and mitigate information security risks relevant to our business. The Company seeks to identify potential risks through various software programs which perform asset and patch management; monitor desktops, laptops and servers; map networks and inventories; and audit file servers. The Company aims to protect itself from potential risks through the implementation of software programs which provide protective measures such as single sign-on, multi-factor identification, content filtering, disk encryption, regular patches and inside threat protection. The Company has implemented a suite of software programs to detect information security events, plans to respond to information security events in accordance with the IRP and BCP, and aims to take proactive steps to recover from information security events through its Disaster Recovery Plan (“DRP”). The DRP prioritizes the swift recovery of information technology systems, data, and infrastructure and the efficient restoration of servers and applications to their normal operational state in the event of a significant disaster.

Insurance. We maintain a breach response insurance policy.
Enterprise Risk Assessment. The Company completes an annual enterprise risk assessment that includes cybersecurity risks and mitigants. The results of the enterprise risk assessment are shared with the Board of Directors on an annual basis.

Implemented Programs for a Hybrid Work Environment. We have implemented initiatives relating to mobile device management, cloud storage services, endpoint protection, and identity and access management. For example, we have implemented a service that focuses on mobile device management and mobile application management, as well as data classification and file server data loss protection measures. We have further implemented endpoint protection and endpoint detection and response which provides visibility that is designed to identify unauthorized systems and applications.
Ongoing Monitoring. Our information security procedures are designed to evolve as information security risks and considerations change over time.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] We monitor our information technology systems, including through the use of information security procedures and risk management systems, and implement initiatives aimed at improving our cybersecurity measures. Our process for assessing, identifying, managing and addressing information security risks include:
Internalization of Information Security Management. We have internalized our information security oversight by hiring a full time Head of Information Technology that has over 20 years of experience in managing information technology and guiding organizations through technology strategy, cybersecurity risk mitigation, information technology process improvement initiatives and digital transformations. He also possesses relevant experience in improving a company's cybersecurity posture and data privacy policies. He holds a Bachelor of Science degree in Information Systems and oversees all of our information security initiatives, assesses cybersecurity risks, provides cybersecurity plans, identifies opportunities for the implementation of additional cybersecurity measures and provides cybersecurity training to our employees and executives.

Third-Party Consultant. We engage a third-party information security consultant to assist in managing our risk posture. This consultant conducts periodic tests and analyses of our defensive and detective information security controls, including annual penetration tests and risk assessments as well as regular vulnerability scans and assessments. The consultant also provides live, interactive annual information security training to our employees and executive officers and monitors the effectiveness of such training through quarterly phishing campaigns. The consultant also assists us in managing cybersecurity risks associated with third-party service providers by administering a due diligence questionnaire for the Company's third-party service providers that includes a cybersecurity risk assessment and provides guidance for remediation of security gaps.

Current Plans and Procedures. The Company has implemented and maintains an incident response plan (“IRP”) and a Business Continuity Plan (“BCP”). The IRP establishes the organization, actions and procedures for recognizing and responding to information security incidents; assessing incidents; notifying the appropriate individuals, regulators or organizations about any incident; organizing the Company’s response activities; escalating the Company’s response efforts to named executive officers and the Board of Directors based on the severity of the incident; and supporting the business recovery efforts made in the aftermath of any incident. The IRP is designed to minimize the operational and financial impacts of an information security incident and is designed to be activated when a local incident responder determines that an incident has occurred. Similarly, our BCP provides details on information security incident response and subsequent business recovery actions.

Risk Identification and Mitigation. The Company aims to identify and mitigate information security risks by using the National Institute of Standards and Technology Cybersecurity Framework (the “NIST Framework”) as a guide to help us identify and mitigate information security risks relevant to our business. The Company seeks to identify potential risks through various software programs which perform asset and patch management; monitor desktops, laptops and servers; map networks and inventories; and audit file servers. The Company aims to protect itself from potential risks through the implementation of software programs which provide protective measures such as single sign-on, multi-factor identification, content filtering, disk encryption, regular patches and inside threat protection. The Company has implemented a suite of software programs to detect information security events, plans to respond to information security events in accordance with the IRP and BCP, and aims to take proactive steps to recover from information security events through its Disaster Recovery Plan (“DRP”). The DRP prioritizes the swift recovery of information technology systems, data, and infrastructure and the efficient restoration of servers and applications to their normal operational state in the event of a significant disaster.

Insurance. We maintain a breach response insurance policy.
Enterprise Risk Assessment. The Company completes an annual enterprise risk assessment that includes cybersecurity risks and mitigants. The results of the enterprise risk assessment are shared with the Board of Directors on an annual basis.

Implemented Programs for a Hybrid Work Environment. We have implemented initiatives relating to mobile device management, cloud storage services, endpoint protection, and identity and access management. For example, we have implemented a service that focuses on mobile device management and mobile application management, as well as data classification and file server data loss protection measures. We have further implemented endpoint protection and endpoint detection and response which provides visibility that is designed to identify unauthorized systems and applications.
Ongoing Monitoring. Our information security procedures are designed to evolve as information security risks and considerations change over time.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Our Board of Directors exercises oversight of information security risk primarily through the Audit Committee. The Head of Information Technology provides information security updates to named executive officers and briefs our Board of Directors and Audit Committee on relevant information security issues on a quarterly basis. We also make available periodic cybersecurity training for members of our Board of Directors.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Board of Directors exercises oversight of information security risk primarily through the Audit Committee.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Board of Directors exercises oversight of information security risk primarily through the Audit Committee. The Head of Information Technology provides information security updates to named executive officers and briefs our Board of Directors and Audit Committee on relevant information security issues on a quarterly basis. We also make available periodic cybersecurity training for members of our Board of Directors.
Cybersecurity Risk Role of Management [Text Block] Our Board of Directors exercises oversight of information security risk primarily through the Audit Committee. The Head of Information Technology provides information security updates to named executive officers and briefs our Board of Directors and Audit Committee on relevant information security issues on a quarterly basis. We also make available periodic cybersecurity training for members of our Board of Directors.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] We have internalized our information security oversight by hiring a full time Head of Information Technology that has over 20 years of experience in managing information technology and guiding organizations through technology strategy, cybersecurity risk mitigation, information technology process improvement initiatives and digital transformations. He also possesses relevant experience in improving a company's cybersecurity posture and data privacy policies. He holds a Bachelor of Science degree in Information Systems and oversees all of our information security initiatives, assesses cybersecurity risks, provides cybersecurity plans, identifies opportunities for the implementation of additional cybersecurity measures and provides cybersecurity training to our employees and executives.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] We have internalized our information security oversight by hiring a full time Head of Information Technology that has over 20 years of experience in managing information technology and guiding organizations through technology strategy, cybersecurity risk mitigation, information technology process improvement initiatives and digital transformations.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] he Head of Information Technology provides information security updates to named executive officers and briefs our Board of Directors and Audit Committee on relevant information security issues on a quarterly basis.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true