XML 21 R10.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management, Strategy and Governance | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Item 1C. Cybersecurity We recognize the importance to our business and reputation of the continuous availability of our internal and client-facing information technology systems, as well as our ability to protect both the confidential information of our clients and our own intellectual property and business information. We are committed to protecting our client and business data and information technology assets and have implemented a cybersecurity program with policies, standards, processes and practices governing the protection and control of information during its lifecycle of creation, usage, transmission, storage and disposal. Cyber Risk Management and Strategy We have implemented and maintain a risk management program that includes processes for the identification, assessment, management and mitigation of cybersecurity risks. This program utilizes numerous technological and human security controls, processes, and procedures to address risks including, but not limited to, those identified by threat intelligence providers, internal stakeholders, and security management programs. Our cybersecurity program is generally aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our risk management program is documented in our written Information Security Policy. We periodically update our Information Security Policy, along with other policies and procedures, to adapt to evolving business conditions and threats. Included in our Information Security Policy is a documented incident response plan to identify, assess, manage and mitigate cybersecurity incidents. As part of our risk management program, we maintain a technology management security team, led by our Information Security Officer (ISO). Among their responsibilities, our technology management security team is responsible for conducting due diligence on software, hardware or services vendors where access to systems or data of Forrester or our clients is contemplated. The security team assesses whether these vendors have appropriate privacy and security controls and whether there are adequate contractual protections in place. We also engage external security assessment vendors from time to time to conduct penetration testing and vulnerability assessments and to report findings to management. All new Forrester employees and contractors receive a copy of the Information Security Policy and are required to undergo information security and privacy training both as part of their onboarding and on an annual basis. We currently also maintain cybersecurity insurance covering the company and its subsidiaries. While to date we are not aware of having experienced any material cybersecurity threats or incidents, and we do not believe that risks from such threats or incidents are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, there can be no guarantee that we will not experience a successful material threat or incident. Additional information on cybersecurity risks we face can be found in “Item 1A, Risk Factors” under the heading “We face risks from network disruptions or security breaches that could damage our reputation and harm our business and operating results.” Governance Related to Cybersecurity Risks Our board has final oversight responsibility over cybersecurity-related matters. Our Chief Technology Officer (CTO) leads the full board in interactive sessions dedicated to cybersecurity risks at least once a year. These sessions address a range of cybersecurity-related topics, such as recent developments in the threat environment, the status of ongoing information security program initiatives, and cybersecurity strategy. In addition, the audit committee assists the board in fulfilling its oversight responsibilities with respect to policies relating to risk assessment and management, including the management of risks arising from cybersecurity threats. The audit committee is responsible for reporting findings related to its review of these matters to the board. With respect to management, our CTO, who reports directly to our chief executive officer, has over 12 years of experience with our company, including more than 6 years serving in technology-based leadership roles. Our VP, Infrastructure, Operations & Security, who reports directly to the CTO, serves as our ISO and has extensive cybersecurity experience gained from over 20 years serving in security-related roles for the Company. Our ISO, together with our technology management security team, is responsible for developing, maintaining and enhancing systems and processes necessary to protect confidential information from loss, theft, and unauthorized access or use. This team also monitors the systems and networks to detect unauthorized activity or access, responding to any such unauthorized attempts to mitigate loss or to ensure the cessation of all unauthorized access to data. If an incident is identified, this team reports such events to the CTO, who will then, as appropriate, advise the chief executive officer, chief legal officer and other management, as well as others, potentially including law enforcement or clients. We have also established a Risk Committee consisting of members of our finance, legal and technology management departments whose duties include assessing the materiality of any identified incidents to help ensure compliance with the SEC's cybersecurity incident disclosure rules.
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Governance Related to Cybersecurity Risks Our board has final oversight responsibility over cybersecurity-related matters. Our Chief Technology Officer (CTO) leads the full board in interactive sessions dedicated to cybersecurity risks at least once a year. These sessions address a range of cybersecurity-related topics, such as recent developments in the threat environment, the status of ongoing information security program initiatives, and cybersecurity strategy. In addition, the audit committee assists the board in fulfilling its oversight responsibilities with respect to policies relating to risk assessment and management, including the management of risks arising from cybersecurity threats. The audit committee is responsible for reporting findings related to its review of these matters to the board. With respect to management, our CTO, who reports directly to our chief executive officer, has over 12 years of experience with our company, including more than 6 years serving in technology-based leadership roles. Our VP, Infrastructure, Operations & Security, who reports directly to the CTO, serves as our ISO and has extensive cybersecurity experience gained from over 20 years serving in security-related roles for the Company. Our ISO, together with our technology management security team, is responsible for developing, maintaining and enhancing systems and processes necessary to protect confidential information from loss, theft, and unauthorized access or use. This team also monitors the systems and networks to detect unauthorized activity or access, responding to any such unauthorized attempts to mitigate loss or to ensure the cessation of all unauthorized access to data. If an incident is identified, this team reports such events to the CTO, who will then, as appropriate, advise the chief executive officer, chief legal officer and other management, as well as others, potentially including law enforcement or clients. We have also established a Risk Committee consisting of members of our finance, legal and technology management departments whose duties include assessing the materiality of any identified incidents to help ensure compliance with the SEC's cybersecurity incident disclosure rules.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | the audit committee assists the board in fulfilling its oversight responsibilities with respect to policies relating to risk assessment and management, including the management of risks arising from cybersecurity threats. The audit committee is responsible for reporting findings related to its review of these matters to the board.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our Chief Technology Officer (CTO) leads the full board in interactive sessions dedicated to cybersecurity risks at least once a year. These sessions address a range of cybersecurity-related topics, such as recent developments in the threat environment, the status of ongoing information security program initiatives, and cybersecurity strategy.
Cybersecurity Risk Role of Management [Text Block] | With respect to management, our CTO, who reports directly to our chief executive officer, has over 12 years of experience with our company, including more than 6 years serving in technology-based leadership roles. Our VP, Infrastructure, Operations & Security, who reports directly to the CTO, serves as our ISO and has extensive cybersecurity experience gained from over 20 years serving in security-related roles for the Company. Our ISO, together with our technology management security team, is responsible for developing, maintaining and enhancing systems and processes necessary to protect confidential information from loss, theft, and unauthorized access or use. This team also monitors the systems and networks to detect unauthorized activity or access, responding to any such unauthorized attempts to mitigate loss or to ensure the cessation of all unauthorized access to data. If an incident is identified, this team reports such events to the CTO, who will then, as appropriate, advise the chief executive officer, chief legal officer and other management, as well as others, potentially including law enforcement or clients. We have also established a Risk Committee consisting of members of our finance, legal and technology management departments whose duties include assessing the materiality of any identified incidents to help ensure compliance with the SEC's cybersecurity incident disclosure rules.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | With respect to management, our CTO, who reports directly to our chief executive officer, has over 12 years of experience with our company, including more than 6 years serving in technology-based leadership roles. Our VP, Infrastructure, Operations & Security, who reports directly to the CTO, serves as our ISO and has extensive cybersecurity experience gained from over 20 years serving in security-related roles for the Company.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Our ISO, together with our technology management security team, is responsible for developing, maintaining and enhancing systems and processes necessary to protect confidential information from loss, theft, and unauthorized access or use. This team also monitors the systems and networks to detect unauthorized activity or access, responding to any such unauthorized attempts to mitigate loss or to ensure the cessation of all unauthorized access to data.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Our ISO, together with our technology management security team, is responsible for developing, maintaining and enhancing systems and processes necessary to protect confidential information from loss, theft, and unauthorized access or use. This team also monitors the systems and networks to detect unauthorized activity or access, responding to any such unauthorized attempts to mitigate loss or to ensure the cessation of all unauthorized access to data. If an incident is identified, this team reports such events to the CTO, who will then, as appropriate, advise the chief executive officer, chief legal officer and other management, as well as others, potentially including law enforcement or clients. We have also established a Risk Committee consisting of members of our finance, legal and technology management departments whose duties include assessing the materiality of any identified incidents to help ensure compliance with the SEC's cybersecurity incident disclosure rules.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration