XML 22 R7.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2025
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]    
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]  
Cybersecurity Risk Management and Strategy
Our processes for assessing, identifying and managing material risks from cybersecurity threats are integrated into our risk management system. We use a variety of tools and processes to collect relevant data and identify, monitor, assess and manage material cybersecurity risks. We invest in cybersecurity defense solutions, including (but not limited to) prevention, detection and response tools and processes. We also have a dedicated global security operations center team, including specially trained personnel (the “
Security Operations Team
”) led by our Global Security Operations Center Director, that is responsible for front-line cybersecurity risk detection and management with the assistance of our critical infrastructure management team. The Security Operations Team engages in ongoing monitoring and testing of our systems and defenses with respect to cybersecurity threats.
We engage independent third parties on a periodic basis to assess our cybersecurity capabilities under the National Institute of Standards and Technology (“
NIST
”) framework. The results of these assessments are shared with the Board of Directors, including the Audit Committee. We also engage third parties to conduct periodic penetration testing, and to provide technical assistance if needed in connection with our response to a cybersecurity incident.
We provide cybersecurity awareness trainings to our employees which are designed to provide guidance for identifying and reporting cybersecurity risks and promote familiarity with our cybersecurity policies, and we require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. We also leverage internal communications to promote awareness and conduct phishing exercises and provide training to employees.
We adopted and implemented an incident response plan, which provides a structured approach for managing, escalating and remediating cybersecurity incidents, as further described below under “Cybersecurity Governance.” There is a business continuity plan in place that covers critical infrastructure. We also have in place a global information security policy and supporting policies and standards covering key risk domains such as asset management, asset control, network security, incident management, third-party risk management and internet and technology use. The company reviews these plans periodically and updates them as needed.
Cybersecurity is also an important part of our third-party risk management program. Through this program, the company seeks to identify, assess and manage risks, including cybersecurity risks, associated with our external service providers. We take a risk-based approach to conducting due diligence in the vendor onboarding process, and we may seek to leverage the use of contractual terms to further mitigate risk. We also assess aspects of our vendors’ cybersecurity posture in certain circumstances.
To date, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations or financial condition. See “Risk Factors—Cybersecurity incidents and other disruptions to our information and operational technology systems, or in our supply chain, could damage our reputation and we could experience a loss of revenue, incur substantial additional costs and become subject to litigation and regulatory scrutiny” for further information about data protection and cybersecurity risks.
Cybersecurity Risk Management Processes Integrated [Flag]   true
Cybersecurity Risk Management Processes Integrated [Text Block]   Our processes for assessing, identifying and managing material risks from cybersecurity threats are integrated into our risk management system. We use a variety of tools and processes to collect relevant data and identify, monitor, assess and manage material cybersecurity risks. We invest in cybersecurity defense solutions, including (but not limited to) prevention, detection and response tools and processes.
Cybersecurity Risk Management Third Party Engaged [Flag]   true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true  
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag]   false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]   To date, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations or financial condition. See “Risk Factors—Cybersecurity incidents and other disruptions to our information and operational technology systems, or in our supply chain, could damage our reputation and we could experience a loss of revenue, incur substantial additional costs and become subject to litigation and regulatory scrutiny” for further information about data protection and cybersecurity risks.
Cybersecurity Risk Board of Directors Oversight [Text Block]  
Cybersecurity Governance
Our management plays an active role in assessing and managing material risks from cybersecurity threats. Our Global Director of Cybersecurity and our Global Vice President of Technology Operations and Data lead efforts to identify, analyze and manage cybersecurity threats and incidents, leveraging their experience and qualifications. Our Global Director of Cybersecurity has over 25 years of experience in cybersecurity in the military and private sectors. During his tenure in the U.S. Air Force, he served tours of duty at the U.S. Cyber Command and the National Security Agency in intelligence and investigations roles. He later worked as a senior counterintelligence official at the Office of the Director of National Intelligence. In the private sector, he helped build the cyber threat intelligence capabilities of Fortune 100 companies. He joined the company in 2017 and was promoted to his current
role in 2020. He holds an Associate of Applied Science degree in Communications Technology, a Bachelor of Arts degree in Russian, and a Master of Arts degree in National Security Affairs from the U.S. Naval Postgraduate School. Our Global Vice President of Technology Operations and Data has over 35 years of experience in information technology and cybersecurity. He joined the company in 2005 and was promoted to his current role in 2021, which merges Technology and Data into one role focusing on the core digital capabilities that support our business transformations. He holds a Bachelor of Science degree in Chemical Engineering, a Postgraduate Degree in Marketing and a Master of Business Administration Degree from the Business School São Paulo, among other degrees.
The Global Director of Cybersecurity and the Global Vice President of Technology Operations and Data are supported by a team of professionals, including both legal experts and technical professionals who are well-versed in the detection, assessment and mitigation of cybersecurity incidents and events and whose job function is dedicated, in whole or in part, to cybersecurity risk management.
We have also established a cross-functional Cybersecurity Disclosure Committee,
co-chaired
by our Global Vice President of Technology Operations and Data and a Global Legal Director, to coordinate and align on effective cybersecurity governance, assessment and reporting. The Cybersecurity Disclosure Committee also includes the Global Director of Cybersecurity and other internal technical and legal experts. The Cybersecurity Disclosure Committee assesses information on certain cybersecurity incidents including, among other things, to assist in making determinations of potential materiality and disclosure for reporting purposes.
Our Board of Directors, together with the Executive Committee, oversees the company’s internal control and overall risk management system. Without prejudice to the responsibilities of the board as a whole and as part of its oversight of the Company’s risk management system, the Audit Committee oversees cybersecurity risk management, reviews the process by which management assesses, manages and mitigates the company’s exposure to cybersecurity risks. The Global Director of Cybersecurity and the Global Vice President of Technology Operations and Data report periodically to members of the Executive Committee and the Audit Committee. In addition, the Global Vice President of Technology Operations and Data reports annually to the entire Board of Directors on cybersecurity.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]   We have also established a cross-functional Cybersecurity Disclosure Committee,
co-chaired
by our Global Vice President of Technology Operations and Data and a Global Legal Director, to coordinate and align on effective cybersecurity governance, assessment and reporting. The Cybersecurity Disclosure Committee also includes the Global Director of Cybersecurity and other internal technical and legal experts.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]   Without prejudice to the responsibilities of the board as a whole and as part of its oversight of the Company’s risk management system, the Audit Committee oversees cybersecurity risk management, reviews the process by which management assesses, manages and mitigates the company’s exposure to cybersecurity risks. The Global Director of Cybersecurity and the Global Vice President of Technology Operations and Data report periodically to members of the Executive Committee and the Audit Committee. In addition, the Global Vice President of Technology Operations and Data reports annually to the entire Board of Directors on cybersecurity.
Cybersecurity Risk Role of Management [Text Block]   Our Board of Directors, together with the Executive Committee, oversees the company’s internal control and overall risk management system. Without prejudice to the responsibilities of the board as a whole and as part of its oversight of the Company’s risk management system, the Audit Committee oversees cybersecurity risk management, reviews the process by which management assesses, manages and mitigates the company’s exposure to cybersecurity risks. The Global Director of Cybersecurity and the Global Vice President of Technology Operations and Data report periodically to members of the Executive Committee and the Audit Committee. In addition, the Global Vice President of Technology Operations and Data reports annually to the entire Board of Directors on cybersecurity.
Cybersecurity Risk Management Positions or Committees Responsible [Flag]   true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]   The Cybersecurity Disclosure Committee assesses information on certain cybersecurity incidents including, among other things, to assist in making determinations of potential materiality and disclosure for reporting purposes.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]   Our management plays an active role in assessing and managing material risks from cybersecurity threats. Our Global Director of Cybersecurity and our Global Vice President of Technology Operations and Data lead efforts to identify, analyze and manage cybersecurity threats and incidents, leveraging their experience and qualifications. Our Global Director of Cybersecurity has over 25 years of experience in cybersecurity in the military and private sectors. During his tenure in the U.S. Air Force, he served tours of duty at the U.S. Cyber Command and the National Security Agency in intelligence and investigations roles. He later worked as a senior counterintelligence official at the Office of the Director of National Intelligence. In the private sector, he helped build the cyber threat intelligence capabilities of Fortune 100 companies. He joined the company in 2017 and was promoted to his current role in 2020. He holds an Associate of Applied Science degree in Communications Technology, a Bachelor of Arts degree in Russian, and a Master of Arts degree in National Security Affairs from the U.S. Naval Postgraduate School. Our Global Vice President of Technology Operations and Data has over 35 years of experience in information technology and cybersecurity. He joined the company in 2005 and was promoted to his current role in 2021, which merges Technology and Data into one role focusing on the core digital capabilities that support our business transformations. He holds a Bachelor of Science degree in Chemical Engineering, a Postgraduate Degree in Marketing and a Master of Business Administration Degree from the Business School São Paulo, among other degrees.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]   Without prejudice to the responsibilities of the board as a whole and as part of its oversight of the Company’s risk management system, the Audit Committee oversees cybersecurity risk management, reviews the process by which management assesses, manages and mitigates the company’s exposure to cybersecurity risks. The Global Director of Cybersecurity and the Global Vice President of Technology Operations and Data report periodically to members of the Executive Committee and the Audit Committee.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag]   true