XML 66 R42.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Risk Management and Strategy We have established information designed to identify, assess, and manage cybersecurity risks that could impact our critical information systems and confidential data. Our information security team employs a variety of methods to identify and evaluate material risks from cybersecurity threats, including risk and control self-assessments, vulnerability assessments and penetration testing, breach and attack simulations, ransomware table-top assessments, cyber threat intelligence reviews, as well as internal and external cybersecurity assessments. To mitigate and manage these risks, we have implemented various technical, physical, and organizational safeguards. Depending on the environment or system, these safeguards include, for example, information security policies and procedures, perimeter security controls such as firewalls and intrusion prevention systems, network security controls including multi-factor authentication and role-based access controls, and server and endpoint security controls such as anti-malware. Additionally, depending on the environment or system, we utilize certain application security controls, data security controls including encryption, data loss prevention controls, immutable data backups, and security awareness programs for our personnel. Our assessment and management of material risks from cybersecurity threats are integrated into our broader enterprise risk management strategies. Cybersecurity risks are categorized according to our enterprise risk assessment guidelines and are tracked in a centralized enterprise risk system. Cybersecurity risks are periodically reviewed by our IT Risk Committee and Enterprise Risk and Compliance Committee (discussed further below). We also engage third-party service providers for assistance in identifying, assessing, and managing cybersecurity risks. In the past, these third parties have provided us with services that include external penetration testing, cybersecurity audits, legal counsel, threat intelligence information, forensic investigations, and managed security service. In addition, we have processes in place for assessing and managing cybersecurity risks associated with third-party service providers. Vendors are categorized based on a set of criteria that assess the importance of their services and the sensitivity of the information and systems they have access to. Depending on the nature of the services provided, the sensitivity of information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with the provider, such as due diligence questionnaires and periodic assessments, and we track the status of reported third party risks within our centralized risk governance framework. In 2023 and 2024, cybersecurity incidents occurred involving our vendors and other contractual counterparties that did not materially and adversely impact our operations. However, we cannot assure that future third party incidents will not materially and adversely impact us. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this annual report on Form 10-K, including “Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, and availability of our information technology systems or data, and those maintained on our behalf, could result in a material adverse impact to our business, including without limitation regulatory investigations or actions, a material interruption to our ability to provide services to our customers, damage to our reputation and/or subject us to costs, fines and penalties or lawsuits and otherwise adversely affect our operations.”
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | To mitigate and manage these risks, we have implemented various technical, physical, and organizational safeguards. Depending on the environment or system, these safeguards include, for example, information security policies and procedures, perimeter security controls such as firewalls and intrusion prevention systems, network security controls including multi-factor authentication and role-based access controls, and server and endpoint security controls such as anti-malware. Additionally, depending on the environment or system, we utilize certain application security controls, data security controls including encryption, data loss prevention controls, immutable data backups, and security awareness programs for our personnel. Our assessment and management of material risks from cybersecurity threats are integrated into our broader enterprise risk management strategies. Cybersecurity risks are categorized according to our enterprise risk assessment guidelines and are tracked in a centralized enterprise risk system. Cybersecurity risks are periodically reviewed by our IT Risk Committee and Enterprise Risk and Compliance Committee (discussed further below). We also engage third-party service providers for assistance in identifying, assessing, and managing cybersecurity risks. In the past, these third parties have provided us with services that include external penetration testing, cybersecurity audits, legal counsel, threat intelligence information, forensic investigations, and managed security service.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Cybersecurity Governance Our Board of Directors addresses Onity’s cybersecurity risk management as part of its general oversight function. The Risk and Compliance Committee of the Board of Directors is responsible for overseeing Onity’s overall risk management processes, including cybersecurity-related risks, and receives periodic updates from the Chief Information Security Officer (CISO) concerning Onity’s significant cybersecurity threats and the processes Onity has implemented to address them. The Chair of our Risk and Compliance Committee and our Lead Independent Director have each received training and certification from the National Association of Corporate Directors Cyber-Risk Oversight Program. Our cybersecurity risk assessment and management processes are implemented and maintained by the CISO and the information security team. The CISO is responsible for cybersecurity staffing and maintaining an up-to-date cybersecurity policy and processes framework designed to promote a strong cybersecurity resilience, drive security awareness, and facilitate a coordinated response to cybersecurity incidents. The IT Risk Committee, which is chaired by the Chief Information Officer (CIO) and includes the CISO, Chief Risk and Compliance Officer (CRCO) and other executive leadership team members, reviews cybersecurity risks and initiatives on a periodic basis. In addition to their decades of experience and qualifications in finance and management, our CIO holds a Bachelor’s Degree in Computer Engineering and Master’s Degree in Computer Science, our CISO holds a Bachelor’s Degree in Electronics Engineering and has completed industry certifications including Certified Information Security Auditor, Certified Information Systems Security Professional, and ISO 27001 Lead Auditor, and our CRCO has received training in financial services cybersecurity risk management for legal professionals. In addition, all Onity executives, along with employees generally, are required to refresh their cybersecurity and IT threat-recognition training annually or more frequently if circumstances warrant. Cybersecurity-related risk events are reported to Onity’s Enterprise Risk and Compliance Committee, an executive level management committee designed to assist the Chief Executive Officer and CRCO in executing our Enterprise Risk Management Program, including with respect to cybersecurity. The Enterprise Risk and Compliance Committee provides a formal governance and oversight infrastructure for identifying and monitoring cybersecurity risks and compliance-related issues facing Onity, which includes escalation to the Risk and Compliance Committee of the Board as appropriate. In addition, our cybersecurity incident response processes are designed to escalate material cybersecurity incidents to members of management as part of the enterprise level Crisis Management Framework. The CISO, CIO, CRCO and senior operating unit leaders are part of the crisis management team in an effort to promote the prompt investigation of and response to cybersecurity incidents.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our Board of Directors addresses Onity’s cybersecurity risk management as part of its general oversight function. The Risk and Compliance Committee of the Board of Directors is responsible for overseeing Onity’s overall risk management processes, including cybersecurity-related risks, and receives periodic updates from the Chief Information Security Officer (CISO) concerning Onity’s significant cybersecurity threats and the processes Onity has implemented to address them. The Chair of our Risk and Compliance Committee and our Lead Independent Director have each received training and certification from the National Association of Corporate Directors Cyber-Risk Oversight Program.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our cybersecurity risk assessment and management processes are implemented and maintained by the CISO and the information security team. The CISO is responsible for cybersecurity staffing and maintaining an up-to-date cybersecurity policy and processes framework designed to promote a strong cybersecurity resilience, drive security awareness, and facilitate a coordinated response to cybersecurity incidents. The IT Risk Committee, which is chaired by the Chief Information Officer (CIO) and includes the CISO, Chief Risk and Compliance Officer (CRCO) and other executive leadership team members, reviews cybersecurity risks and initiatives on a periodic basis.
Cybersecurity Risk Role of Management [Text Block] | Our Board of Directors addresses Onity’s cybersecurity risk management as part of its general oversight function. The Risk and Compliance Committee of the Board of Directors is responsible for overseeing Onity’s overall risk management processes, including cybersecurity-related risks, and receives periodic updates from the Chief Information Security Officer (CISO) concerning Onity’s significant cybersecurity threats and the processes Onity has implemented to address them. The Chair of our Risk and Compliance Committee and our Lead Independent Director have each received training and certification from the National Association of Corporate Directors Cyber-Risk Oversight Program. Our cybersecurity risk assessment and management processes are implemented and maintained by the CISO and the information security team. The CISO is responsible for cybersecurity staffing and maintaining an up-to-date cybersecurity policy and processes framework designed to promote a strong cybersecurity resilience, drive security awareness, and facilitate a coordinated response to cybersecurity incidents. The IT Risk Committee, which is chaired by the Chief Information Officer (CIO) and includes the CISO, Chief Risk and Compliance Officer (CRCO) and other executive leadership team members, reviews cybersecurity risks and initiatives on a periodic basis. In addition to their decades of experience and qualifications in finance and management, our CIO holds a Bachelor’s Degree in Computer Engineering and Master’s Degree in Computer Science, our CISO holds a Bachelor’s Degree in Electronics Engineering and has completed industry certifications including Certified Information Security Auditor, Certified Information Systems Security Professional, and ISO 27001 Lead Auditor, and our CRCO has received training in financial services cybersecurity risk management for legal professionals. In addition, all Onity executives, along with employees generally, are required to refresh their cybersecurity and IT threat-recognition training annually or more frequently if circumstances warrant. Cybersecurity-related risk events are reported to Onity’s Enterprise Risk and Compliance Committee, an executive level management committee designed to assist the Chief Executive Officer and CRCO in executing our Enterprise Risk Management Program, including with respect to cybersecurity. The Enterprise Risk and Compliance Committee provides a formal governance and oversight infrastructure for identifying and monitoring cybersecurity risks and compliance-related issues facing Onity, which includes escalation to the Risk and Compliance Committee of the Board as appropriate. In addition, our cybersecurity incident response processes are designed to escalate material cybersecurity incidents to members of management as part of the enterprise level Crisis Management Framework. The CISO, CIO, CRCO and senior operating unit leaders are part of the crisis management team in an effort to promote the prompt investigation of and response to cybersecurity incidents.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Cybersecurity-related risk events are reported to Onity’s Enterprise Risk and Compliance Committee, an executive level management committee designed to assist the Chief Executive Officer and CRCO in executing our Enterprise Risk Management Program, including with respect to cybersecurity.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | In addition to their decades of experience and qualifications in finance and management, our CIO holds a Bachelor’s Degree in Computer Engineering and Master’s Degree in Computer Science, our CISO holds a Bachelor’s Degree in Electronics Engineering and has completed industry certifications including Certified Information Security Auditor, Certified Information Systems Security Professional, and ISO 27001 Lead Auditor, and our CRCO has received training in financial services cybersecurity risk management for legal professionals. In addition, all Onity executives, along with employees generally, are required to refresh their cybersecurity and IT threat-recognition training annually or more frequently if circumstances warrant.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Cybersecurity-related risk events are reported to Onity’s Enterprise Risk and Compliance Committee, an executive level management committee designed to assist the Chief Executive Officer and CRCO in executing our Enterprise Risk Management Program, including with respect to cybersecurity. The Enterprise Risk and Compliance Committee provides a formal governance and oversight infrastructure for identifying and monitoring cybersecurity risks and compliance-related issues facing Onity, which includes escalation to the Risk and Compliance Committee of the Board as appropriate.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration