XML 313 R9.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Abstract]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] Item 16K. Cybersecurity 

We believe cybersecurity, which is a part of our broader risk management framework is key to the Company achieving its strategic goals and objectives. Based on the nature of our business and the industry in which we operate, we are faced with a variety of cybersecurity threats including phishing emails, ransomware attacks, malicious attachments, social engineering attacks and denial of service attacks, among others. Our customers, suppliers, subcontractors and partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations.

 

Our information security organization has implemented a governance structure and processes to assess, identify, manage and report cybersecurity risks. We also engage third-party service providers to conduct evaluations of our security controls, including testing both the design and operational effectiveness of security controls. We conduct internal due diligence of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards, including strict controls of privileged access granted to service providers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

 

In the event of an incident, we intend to follow our incident management procedures, which outline the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal, compliance and internal audit), as well as senior leadership and the Board, as appropriate.

 

On a regular basis, the Company analyzes its internet-based services to identify vulnerabilities and assesses the protection and the detection capabilities. The cybersecurity compliance status of assets is centrally evaluated across the Company’s global sites and business and operational functions. Results are shared within the Company’s relevant business units and across global functions. The Company implements corrective measures and improvement actions in response to these processes, as appropriate. Data classification and protection tools are in place, such as the implementation of a specific process and technology aimed at detecting and responding to abnormal data flows.

 

Cybersecurity risks and threats, including as a result of any previous cybersecurity incidents, have not materially impacted and are not reasonably expected to materially impact us or our operations to date. However, we recognize the ever-evolving cyber risk landscape and cannot provide any assurances that we will not be subject to a material cybersecurity incident in the future.

 
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Our information security organization has implemented a governance structure and processes to assess, identify, manage and report cybersecurity risks
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] The Board of Directors and our Audit Committee oversee management’s processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Senior leadership have developed a process to regularly brief the Audit Committee and Board of Directors on our cybersecurity and information security policies and procedures, and the Board of Directors will be apprised of cybersecurity incidents deemed to have a potential material impact on the Company
Cybersecurity Risk Role of Management [Text Block] Governance 

The Board of Directors and our Audit Committee oversee management’s processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership have developed a process to regularly brief the Audit Committee and Board of Directors on our cybersecurity and information security policies and procedures, and the Board of Directors will be apprised of cybersecurity incidents deemed to have a potential material impact on the Company.

 

The CFO and VP Finance are responsible for managing cybersecurity risks. Both have experience through years of service as leaders in corporate administration including managing IT systems in their former roles. They oversee the activities of the Company’s outsourced IT firm, which assists with managing our overall information security strategy, policy, cyber threat detection and response, cyber architecture and processes for the security of our network and intellectual property. Various technologies and techniques are used to monitor and manage cybersecurity risks. Policies and processes are regularly updated.

 
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The CFO and VP Finance are responsible for managing cybersecurity risks
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Both have experience through years of service as leaders in corporate administration including managing IT systems in their former roles