XML 24 R11.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management, Strategy and Governance
 12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Item 1C. CYBERSECURITY

 

Risk Management and Strategy

 

The Company recognizes the importance of developing, implementing and maintaining cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data. The Company maintains a cybersecurity program to assess, identify and manage cybersecurity threat risks. The Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the Company’s cybersecurity policies, processes, and practices, which are integrated into the Company’s overall risk management process. To help protect the Company’s information systems from cybersecurity threats, the Company uses various security tools and personnel that help the Company identify, escalate, investigate, resolve, and recover from security incidents.

 

Managing Material Risks & Integrated Overall Risk Management

 

The Company has incorporated cybersecurity risk management within its Enterprise Risk Management framework. Led by the Company’s Senior Vice President of Operations, the Company's risk management team, comprised of senior management team members, integrates the evaluation of cybersecurity risks in accordance with its business objectives, operational needs, and legal requirements.

Acknowledging the intricate and dynamic landscape of cybersecurity threats, the Company collaborates with external experts, such as cybersecurity assessors, consultants, and auditors, to assess and test its risk mitigation tools. The Company’s

engagement with these external entities encompasses routine reviews, threat assessments, and ongoing consultations to enhance the Company’s security measures.

Prior to engagement, the Company undertakes security assessments of third-party providers that process or store confidential Company information, and monitors their activities for alignment with the Company’s cybersecurity standards. This monitoring involves evaluations performed by the Company’s team of security analysts, and annual review by the Company’s Chief Information Security Officer (“CISO”).

 

Risks from Cybersecurity Threats

 

To date, the Company believes that the risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Refer to the risk factor captioned “A failure in the Company’s operational systems or infrastructure or those of third parties, including security breaches or cyber-attacks, could disrupt the Company’s business, its reputation, and / or cause losses which would have a material effect on the Company’s business operations and financial results” in Part I, Item 1A. “Risk Factors” for additional information on cybersecurity risks that could adversely impact the Company’s business, results of operations or financial condition.

 

Governance

 

Management’s Role Managing Risk

 

The CISO advises the Enterprise Risk Management Committee (the “ERM Committee”) of the Board of Directors on cybersecurity risks. The CISO provides the following information to the ERM Committee on a quarterly basis:

•
Company threat profile and emerging threats;
•
Status of cybersecurity initiatives and strategies;
•
Incident reports and learnings from any cybersecurity events; and
•
Compliance with regulatory requirements and industry standards.

The Company conducts an annual review of the Company’s cybersecurity posture and the effectiveness of its risk mitigation strategies. This review helps in identifying areas for improvement and aligning cybersecurity efforts with the overall risk management framework.

 

Risk Management Personnel

 

Primary responsibility for assessing, monitoring, and managing the Company’s cybersecurity risks rests with the CISO. The CISO, has obtained cybersecurity credentials for the role, possesses expertise in the technical domain, and receives assistance from industry experts in decision-making. The CISO oversees the information security policies and data protection programs, implementation of protective and detective tools, tests the Company’s compliance with standards, and remediates known risks. These initiatives include phishing simulations, semi-annual cybersecurity education to employees, and competency assessments. Additionally, the Company conducts table-top incident response practices and other measures to enhance overall cybersecurity preparedness. These efforts underscore the organization's commitment to addressing a wide range of potential threats and cybersecurity challenges.

 

Monitoring Cybersecurity Incidents

 

The CISO is informed about the developments in cybersecurity, including potential threats and risk management techniques. This ongoing knowledge acquisition is crucial for the prevention, detection, mitigation, and remediation of cybersecurity incidents. In the event of a cybersecurity incident, the CISO is equipped with a cyber incident response plan (“CIRP”) supported by a cross-functional cyber incident response team (“CIRT”). The CIRT oversees and responds to cybersecurity incidents. Its core objectives encompass detection and response, conducting incident analysis and investigation, implementing containment and eradication measures, and facilitating recovery processes. It also entails coordinating and communicating with the Company's management, regulators, affected parties, and external security experts. The CIRT

determines the materiality of the incident, maintains documentation and reporting practices, and fosters a culture of improvement.

 

Reporting to Board of Directors

 

The ERM Committee is central to the Board’s oversight of cybersecurity risks and bears the primary responsibility for this area. The CISO, in his capacity, informs the Chief Executive Officer, the Chief Financial Officer, the Chief Audit Executive, the Chief Information Officer, and the Legal Department of aspects related to cybersecurity risks and incidents. Furthermore, the CISO escalates significant cybersecurity matters to the ERM Committee.

The Board has established oversight mechanisms to govern risks associated with cybersecurity threats because they recognize the significance of these threats to the Company’s operational integrity and stakeholder confidence.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]

Managing Material Risks & Integrated Overall Risk Management

 

The Company has incorporated cybersecurity risk management within its Enterprise Risk Management framework. Led by the Company’s Senior Vice President of Operations, the Company's risk management team, comprised of senior management team members, integrates the evaluation of cybersecurity risks in accordance with its business objectives, operational needs, and legal requirements.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

The Board has established oversight mechanisms to govern risks associated with cybersecurity threats because they recognize the significance of these threats to the Company’s operational integrity and stakeholder confidence.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The ERM Committee is central to the Board’s oversight of cybersecurity risks and bears the primary responsibility for this area.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The CISO, in his capacity, informs the Chief Executive Officer, the Chief Financial Officer, the Chief Audit Executive, the Chief Information Officer, and the Legal Department of aspects related to cybersecurity risks and incidents. Furthermore, the CISO escalates significant cybersecurity matters to the ERM Committee.
Cybersecurity Risk Role of Management [Text Block]

Management’s Role Managing Risk

 

The CISO advises the Enterprise Risk Management Committee (the “ERM Committee”) of the Board of Directors on cybersecurity risks. The CISO provides the following information to the ERM Committee on a quarterly basis:

•
Company threat profile and emerging threats;
•
Status of cybersecurity initiatives and strategies;
•
Incident reports and learnings from any cybersecurity events; and
•
Compliance with regulatory requirements and industry standards.

The Company conducts an annual review of the Company’s cybersecurity posture and the effectiveness of its risk mitigation strategies. This review helps in identifying areas for improvement and aligning cybersecurity efforts with the overall risk management framework.
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Primary responsibility for assessing, monitoring, and managing the Company’s cybersecurity risks rests with the CISO.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The CISO, has obtained cybersecurity credentials for the role, possesses expertise in the technical domain, and receives assistance from industry experts in decision-making.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]

The CISO advises the Enterprise Risk Management Committee (the “ERM Committee”) of the Board of Directors on cybersecurity risks. The CISO provides the following information to the ERM Committee on a quarterly basis:

•
Company threat profile and emerging threats;
•
Status of cybersecurity initiatives and strategies;
•
Incident reports and learnings from any cybersecurity events; and
•
Compliance with regulatory requirements and industry standards.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true