XML 42 R25.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Risk Management and Strategy

The Company manages cybersecurity risk as part of our overall enterprise risk management strategy, which is overseen by the Audit Committee and the Board. The Company employs robust cybersecurity and data privacy programs to assess, identify and manage material risks from cybersecurity threats.

We are constantly evolving our cyber defenses to minimize impacts from cyber threats by using a multi-pronged approach that helps safeguard our assets and data. We are particularly focused on addressing emerging cybersecurity risks, including human risk, as phishing attacks remain one of the most common causes of data breaches; third-party supply chain risks, as threat actors continue to target supply chains to compromise a greater number of victims; and geopolitical risk, as tensions and conflicts around the world are often accompanied by an increase in sabotage, espionage and cyber-attacks. As threat actors frequently target employees to gain access to information and systems, we have a comprehensive human risk management program that educates our workforce on threats they face as a first line of defense, and includes elements addressing phishing, malware, data handling, device security, cybersecurity education, password security, internet browsing and defenses to physical threats. Our employees are exposed to cybersecurity awareness training and training to keep pace with industry standards, evolving challenges and innovative solutions with respect to information security, data privacy, and cybersecurity risks to the organization. Additionally, we employ a multi-layered approach in our application of cybersecurity technologies to help safeguard our systems, networks, and data from potential cybersecurity threats.

To support our preparedness, we have a cybersecurity incident response plan (“CIRP”) that we regularly update as business needs and the security landscapes change. In the event of a cybersecurity incident, our incident response team refers to our CIRP and existing management internal controls and disclosure processes. Pursuant to this process, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to the Company’s systems and networks, minimizing the impact on the Company’s stakeholders, analyzing and executing upon internal reporting obligations, escalating information about the incident to senior management, as appropriate, and performing post-incident analysis and program enhancements, as needed. We perform periodic tabletop exercises annually to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.

We recognize that third parties that provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To manage third-party risk, we maintain a third-party risk management program,which is designed to assess the security controls of our third parties. The assessment methodology is based on risk and relies on the data, access, connectivity, and criticality of the services that the third-party offers.

We maintain relationships with legal counsel to inform our cybersecurity and data privacy programs.

As of December 31, 2024, and through the date of this filing, we are not aware of any material cybersecurity incidents that have impacted the Company. We face risks of incidents, whether through cyber attacks or cyber intrusions through the Cloud, the Internet, phishing attempts, ransomware and other forms of malware, computer viruses, email attachments, extortion, and other scams. Although we make efforts to maintain the security and integrity of our information technology systems, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them, are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors’ systems that could adversely affect our business.

Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Company manages cybersecurity risk as part of our overall enterprise risk management strategy, which is overseen by the Audit Committee and the Board.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] As of December 31, 2024, and through the date of this filing, we are not aware of any material cybersecurity incidents that have impacted the Company.
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The information security team responsible for managing and implementing the Company’s cybersecurity and data privacy programs has many years of valuable business experience managing risks from cybersecurity threats and data privacy breaches and developing and implementing cybersecurity and data privacy policies and procedures.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]

Our Audit Committee, which consists solely of independent directors, oversees the Company’s overall enterprise risk assessment and risk management policies and guidelines, including risks related to cybersecurity matters. Our Audit Committee reviews, discusses with management and oversees the Company’s information security and data protection programs. In particular, the Audit Committee receives periodic updates from the IT Director, internal audit function and other members of management on significant cybersecurity and data privacy threats to our systems and the potential impact on the Company’s business, financial results, operations, and reputation, risk management strategies, including information governance and security policies and programs, program assessments, planned improvements, major legislative and regulatory developments that could materially impact the Company’s cybersecurity and data privacy policies and programs, and status of information security initiatives, including an appropriate threat assessment relating to information technology risks. The Board also receives similar cybersecurity updates directly from the IT Director and other members of management at least annually, and as needed from time to time.

Cybersecurity Risk Board of Directors Oversight [Text Block]

Governance

The Company’s cybersecurity and data privacy programs are implemented and overseen by the Company’s designated director of information systems (“IT Director”) and senior management. The information security team responsible for managing and implementing the Company’s cybersecurity and data privacy programs has many years of valuable business experience managing risks from cybersecurity threats and data privacy breaches and developing and implementing cybersecurity and data privacy policies and procedures.

Our Audit Committee, which consists solely of independent directors, oversees the Company’s overall enterprise risk assessment and risk management policies and guidelines, including risks related to cybersecurity matters. Our Audit Committee reviews, discusses with management and oversees the Company’s information security and data protection programs. In particular, the Audit Committee receives periodic updates from the IT Director, internal audit function and other members of management on significant cybersecurity and data privacy threats to our systems and the potential impact on the Company’s business, financial results, operations, and reputation, risk management strategies, including information governance and security policies and programs, program assessments, planned improvements, major legislative and regulatory developments that could materially impact the Company’s cybersecurity and data privacy policies and programs, and status of information security initiatives, including an appropriate threat assessment relating to information technology risks. The Board also receives similar cybersecurity updates directly from the IT Director and other members of management at least annually, and as needed from time to time.