XML 19 R8.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Cybersecurity Risk
Management
and Strategy
Our processes for assessing, identifying and managing material risks from cybersecurity threats are integrated into our risk management system. We use a variety of tools and processes to collect relevant data and identify, monitor, assess and manage material cybersecurity risks. We invest in cybersecurity defense solutions, including (but not limited to) prevention, detection and response tools and processes. We also have a dedicated global security operations center team, including specially trained personnel (the “
Security Operations Team
”) led by our Global Security Operations Center Director, that is responsible for front-line cybersecurity risk detection and management with the assistance of our critical infrastructure management team. The Security Operations Team engages in ongoing monitoring and testing of our systems and defenses with respect to cybersecurity
threats
.
 
We engage independent third parties on a periodic basis to assess our cybersecurity capabilities under the National Institute of Standards and Technology (“
NIST
”) framework. The results of these assessments are shared with the Board of Directors, including the Audit Committee. We also engage third parties to conduct periodic penetration testing, and to provide technical assistance if needed in connection with our response to a cybersecurity incident.
We provide cybersecurity awareness trainings to our employees which are designed to provide guidance for identifying and reporting cybersecurity
risks
and promote familiarity with our cybersecurity policies, and we require employees in certain roles to complete additional role-based, specialized cybersecurity trainings and incident simulations. We also leverage internal communications to promote awareness and conduct phishing exercises and provide training to employees.
We adopted and implemented an incident response plan, which provides a structured approach for managing, escalating and remediating cybersecurity incidents, as further described below under “Cybersecurity Governance.” There is a business continuity plan in place that covers critical infrastructure. We also have in place a global information security policy and supporting policies and standards covering key risk domains such as asset management, asset control, network security, incident management, third-party risk management and internet and technology use. The company reviews these plans periodically and updates them as needed.
Cybersecurity is also an important part of our third-party risk management program. Through this program, the company seeks to identify, assess and manage risks, including cybersecurity risks, associated with our external service providers. We take a risk-based approach to conducting due diligence in the vendor onboarding process, and we may seek to leverage the use of contractual terms to further mitigate risk. We also assess aspects of our vendors’ cybersecurity posture in certain circumstances.
To date, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations or financial condition. See “Risk Factors—Cybersecurity incidents and other disruptions to our information and operational technology systems, or in our supply chain, could damage our reputation and we could experience a loss of revenue, incur substantial additional costs and become subject to litigation and regulatory scrutiny” for further information about data protection and cybersecurity risks.
Cybersecurity Governance
Our management plays an active role in assessing and managing material risks from cybersecurity threats. Our Global Director of Cybersecurity and our Global Vice President of Technology Operations and Data lead efforts to identify, analyze and manage cybersecurity threats and incidents, leveraging their experience and qualifications. Our Senior Global Director of Cybersecurity has over 19 years of experience in IT and cybersecurity in the private sector, with expertise in cybersecurity engineering and architecture. During his career he has served and helped build cybersecurity capabilities at Global Fortune 100 companies in the Biotechnology and Financial Services sectors. He joined the company in 2016 and was promoted to his current role in 2025. He holds a Bachelor of Science Degree in Computer Science and Mathematics from Webster University, several advanced Cybersecurity professional certifications, and is a 2023 FBI Citizens Academy graduate. Our Global Vice President of Technology Operations and Data has over 35 years of experience in information technology and cybersecurity. He joined the company in 2005 and was promoted to his current role in 2021, which merges Technology and Data into one role focusing on the core digital capabilities that support our business transformations. He holds a Bachelor of Science degree in Chemical Engineering, a Postgraduate Degree in Marketing and a Master of Business Administration Degree from the Business School São Paulo, among other degrees.
The Global Director of Cybersecurity and the Global Vice President of Technology Operations and Data are supported by a team of professionals, including both legal experts and technical professionals who are well-versed in the detection, assessment and mitigation of cybersecurity incidents and events and whose job function is dedicated, in whole or in part, to cybersecurity risk management.
 
We have also established a cross-functional C
ybersecurity Disclosure Committee
,
co-chaired
by our Global Vice President of Technology Operations and Data and a Global Legal Director, to coordinate and align on effective cybersecurity governance, assessment and reporting. The Cybersecurity Disclosure Committee also includes the Global Director of Cybersecurity and other internal technical and legal experts. The Cybersecurity Disclosure Committee assesses information on certain cybersecurity incidents including, among other things, to assist in making determinations of potential mat
eriali
ty and disclosure for reporting purposes.
Our Board of Directors, together with the Execu
tiv
e Committee, oversees the company’s internal control and overall risk management system. Without prejudice to the responsibilities of the board as a whole and as part of its oversight of the Company’s risk management system, the Audit Committee oversees cybersecurity risk management, reviews the process by which management assesses, manages and mitigates the company’s exposure to cybersecurity risks. The Global Director of Cybersecurity and the Global Vice President of Technology Operations and Data report periodically to members of the Executive Committee and the Audit Committee. In addition, the Global Vice President of Technology Operations and Data
reports annually to the entire Board of Directors on cybersecurity
.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
Our processes for assessing, identifying and managing material risks from cybersecurity threats are integrated into our risk management system. We use a variety of tools and processes to collect relevant data and identify, monitor, assess and manage material cybersecurity risks. We invest in cybersecurity defense solutions, including (but not limited to) prevention, detection and response tools and processes. We also have a dedicated global security operations center team, including specially trained personnel (the “
Security Operations Team
”) led by our Global Security Operations Center Director, that is responsible for front-line cybersecurity risk detection and management with the assistance of our critical infrastructure management team. The Security Operations Team engages in ongoing monitoring and testing of our systems and defenses with respect to cybersecurity
threats
.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]
To date, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations or financial condition. See “Risk Factors—Cybersecurity incidents and other disruptions to our information and operational technology systems, or in our supply chain, could damage our reputation and we could experience a loss of revenue, incur substantial additional costs and become subject to litigation and regulatory scrutiny” for further information about data protection and cybersecurity risks.
Cybersecurity Risk Board of Directors Oversight [Text Block]
Our Board of Directors, together with the Execu
tiv
e Committee, oversees the company’s internal control and overall risk management system. Without prejudice to the responsibilities of the board as a whole and as part of its oversight of the Company’s risk management system, the Audit Committee oversees cybersecurity risk management, reviews the process by which management assesses, manages and mitigates the company’s exposure to cybersecurity risks. The Global Director of Cybersecurity and the Global Vice President of Technology Operations and Data report periodically to members of the Executive Committee and the Audit Committee. In addition, the Global Vice President of Technology Operations and Data
reports annually to the entire Board of Directors on cybersecurity
.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
Our Board of Directors, together with the Execu
tiv
e Committee, oversees the company’s internal control and overall risk management system. Without prejudice to the responsibilities of the board as a whole and as part of its oversight of the Company’s risk management system, the Audit Committee oversees cybersecurity risk management, reviews the process by which management assesses, manages and mitigates the company’s exposure to cybersecurity risks. The Global Director of Cybersecurity and the Global Vice President of Technology Operations and Data report periodically to members of the Executive Committee and the Audit Committee. In addition, the Global Vice President of Technology Operations and Data
reports annually to the entire Board of Directors on cybersecurity
.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
We have also established a cross-functional C
ybersecurity Disclosure Committee
,
co-chaired
by our Global Vice President of Technology Operations and Data and a Global Legal Director, to coordinate and align on effective cybersecurity governance, assessment and reporting. The Cybersecurity Disclosure Committee also includes the Global Director of Cybersecurity and other internal technical and legal experts. The Cybersecurity Disclosure Committee assesses information on certain cybersecurity incidents including, among other things, to assist in making determinations of potential mat
eriali
ty and disclosure for reporting purposes.
Our Board of Directors, together with the Execu
tiv
e Committee, oversees the company’s internal control and overall risk management system. Without prejudice to the responsibilities of the board as a whole and as part of its oversight of the Company’s risk management system, the Audit Committee oversees cybersecurity risk management, reviews the process by which management assesses, manages and mitigates the company’s exposure to cybersecurity risks. The Global Director of Cybersecurity and the Global Vice President of Technology Operations and Data report periodically to members of the Executive Committee and the Audit Committee. In addition, the Global Vice President of Technology Operations and Data
reports annually to the entire Board of Directors on cybersecurity
.
Cybersecurity Risk Role of Management [Text Block]
Our management plays an active role in assessing and managing material risks from cybersecurity threats. Our Global Director of Cybersecurity and our Global Vice President of Technology Operations and Data lead efforts to identify, analyze and manage cybersecurity threats and incidents, leveraging their experience and qualifications. Our Senior Global Director of Cybersecurity has over 19 years of experience in IT and cybersecurity in the private sector, with expertise in cybersecurity engineering and architecture. During his career he has served and helped build cybersecurity capabilities at Global Fortune 100 companies in the Biotechnology and Financial Services sectors. He joined the company in 2016 and was promoted to his current role in 2025. He holds a Bachelor of Science Degree in Computer Science and Mathematics from Webster University, several advanced Cybersecurity professional certifications, and is a 2023 FBI Citizens Academy graduate. Our Global Vice President of Technology Operations and Data has over 35 years of experience in information technology and cybersecurity. He joined the company in 2005 and was promoted to his current role in 2021, which merges Technology and Data into one role focusing on the core digital capabilities that support our business transformations. He holds a Bachelor of Science degree in Chemical Engineering, a Postgraduate Degree in Marketing and a Master of Business Administration Degree from the Business School São Paulo, among other degrees.
The Global Director of Cybersecurity and the Global Vice President of Technology Operations and Data are supported by a team of professionals, including both legal experts and technical professionals who are well-versed in the detection, assessment and mitigation of cybersecurity incidents and events and whose job function is dedicated, in whole or in part, to cybersecurity risk management.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
We engage independent third parties on a periodic basis to assess our cybersecurity capabilities under the National Institute of Standards and Technology (“
NIST
”) framework. The results of these assessments are shared with the Board of Directors, including the Audit Committee. We also engage third parties to conduct periodic penetration testing, and to provide technical assistance if needed in connection with our response to a cybersecurity incident.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]
Our management plays an active role in assessing and managing material risks from cybersecurity threats. Our Global Director of Cybersecurity and our Global Vice President of Technology Operations and Data lead efforts to identify, analyze and manage cybersecurity threats and incidents, leveraging their experience and qualifications. Our Senior Global Director of Cybersecurity has over 19 years of experience in IT and cybersecurity in the private sector, with expertise in cybersecurity engineering and architecture. During his career he has served and helped build cybersecurity capabilities at Global Fortune 100 companies in the Biotechnology and Financial Services sectors. He joined the company in 2016 and was promoted to his current role in 2025. He holds a Bachelor of Science Degree in Computer Science and Mathematics from Webster University, several advanced Cybersecurity professional certifications, and is a 2023 FBI Citizens Academy graduate. Our Global Vice President of Technology Operations and Data has over 35 years of experience in information technology and cybersecurity. He joined the company in 2005 and was promoted to his current role in 2021, which merges Technology and Data into one role focusing on the core digital capabilities that support our business transformations. He holds a Bachelor of Science degree in Chemical Engineering, a Postgraduate Degree in Marketing and a Master of Business Administration Degree from the Business School São Paulo, among other degrees.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
We have also established a cross-functional C
ybersecurity Disclosure Committee
,
co-chaired
by our Global Vice President of Technology Operations and Data and a Global Legal Director, to coordinate and align on effective cybersecurity governance, assessment and reporting. The Cybersecurity Disclosure Committee also includes the Global Director of Cybersecurity and other internal technical and legal experts. The Cybersecurity Disclosure Committee assesses information on certain cybersecurity incidents including, among other things, to assist in making determinations of potential mat
eriali
ty and disclosure for reporting purposes.
Our Board of Directors, together with the Execu
tiv
e Committee, oversees the company’s internal control and overall risk management system. Without prejudice to the responsibilities of the board as a whole and as part of its oversight of the Company’s risk management system, the Audit Committee oversees cybersecurity risk management, reviews the process by which management assesses, manages and mitigates the company’s exposure to cybersecurity risks. The Global Director of Cybersecurity and the Global Vice President of Technology Operations and Data report periodically to members of the Executive Committee and the Audit Committee. In addition, the Global Vice President of Technology Operations and Data
reports annually to the entire Board of Directors on cybersecurity
.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true